Description

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.

Remediation

References

CVE-2022-42127

Related Vulnerabilities

WordPress Plugin Jigoshop Information Disclosure (1.17.9)

Apache HTTP Server CVE-2005-2700 Vulnerability (CVE-2005-2700)

WordPress Plugin Pay With Tweet SQL Injection and Cross-Site Scripting Vulnerabilities (1.1)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-0309)

MySQL CVE-2018-2759 Vulnerability (CVE-2018-2759)

Severity

Medium

Classification

CVE-2022-42127 CWE-276 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities