VULNERABILITY INTELLIGENCE

CVE-2022-42126

CVSS score4.3 MEDIUM
EPSS probability0.69%
CISA KEVNot currently listed
Published2022-11-15
Last modified2026-07-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Weakness classification

  • CWE-284: Improper Access Control

Primary references