Description

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

Remediation

References

CVE-2022-42127

Related Vulnerabilities

WordPress Plugin Search Unleashed 'Log' Function HTML Injection (0.2.10)

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files Multiple Vulnerabilities (1.6.0)

SugarCRM Improper Input Validation Vulnerability (CVE-2012-0694)

WordPress Plugin Flog Cross-Site Scripting (0.1)

WordPress Plugin Stars Menu Cross-Site Scripting (1.0.1)

Severity

Medium

Classification

CVE-2022-42127 CWE-276 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities