The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
Weakness
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_experience_platform | Liferay | 7.4-update81 (including) | 7.4-update81 (including) |
| Digital_experience_platform | Liferay | 7.4-update82 (including) | 7.4-update82 (including) |
| Digital_experience_platform | Liferay | 7.4-update83 (including) | 7.4-update83 (including) |
| Digital_experience_platform | Liferay | 7.4-update84 (including) | 7.4-update84 (including) |
| Digital_experience_platform | Liferay | 7.4-update85 (including) | 7.4-update85 (including) |
| Liferay_portal | Liferay | 7.4.3.81 (including) | 7.4.3.85 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/127.html
- https://cwe.mitre.org/data/definitions/143.html
- https://cwe.mitre.org/data/definitions/144.html
- https://cwe.mitre.org/data/definitions/668.html
- https://cwe.mitre.org/data/definitions/87.html