4.3
CVE-2022-26595
- EPSS 0.11%
- Published 19.04.2022 13:15:08
- Last modified 21.11.2024 06:54:11
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Data is provided by the National Vulnerability Database (NVD)
Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_13
Liferay ≫ Digital Experience Platform Version7.3 Updatefix_pack_2
Liferay ≫ Liferay Portal Version7.3.7
Liferay ≫ Liferay Portal Version7.4.0
Liferay ≫ Liferay Portal Version7.4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.11% | 0.311 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-276 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.