UpHeron
All vulnerabilities

Servers and applications

CVE-2022-26595

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

Severity
Medium 4.3
Published
19 Apr 2022
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.2-fix_pack_13
  • Version 7.3-fix_pack_2
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • Version 7.3.7
  • Version 7.4.0
  • Version 7.4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-26595
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-26595