The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
Severity
Medium 4.3
Published
24 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
Version 7.4-update60
Version 7.4-update59
Version 7.4-update58
Version 7.4-update57
All 60 release lines
Version 7.4-update1
Version 7.4-update2
Version 7.4-update3
Version 7.4-update4
Version 7.4-update5
Version 7.4-update6
Version 7.4-update7
Version 7.4-update8
Version 7.4-update9
Version 7.4-update10
Version 7.4-update11
Version 7.4-update12
Version 7.4-update13
Version 7.4-update14
Version 7.4-update15
Version 7.4-update16
Version 7.4-update17
Version 7.4-update18
Version 7.4-update19
Version 7.4-update20
Version 7.4-update21
Version 7.4-update22
Version 7.4-update23
Version 7.4-update24
Version 7.4-update25
Version 7.4-update26
Version 7.4-update27
Version 7.4-update28
Version 7.4-update29
Version 7.4-update30
Version 7.4-update31
Version 7.4-update32
Version 7.4-update33
Version 7.4-update34
Version 7.4-update35
Version 7.4-update36
Version 7.4-update37
Version 7.4-update38
Version 7.4-update39
Version 7.4-update40
Version 7.4-update41
Version 7.4-update42
Version 7.4-update43
Version 7.4-update44
Version 7.4-update45
Version 7.4-update46
Version 7.4-update47
Version 7.4-update48
Version 7.4-update49
Version 7.4-update50
Version 7.4-update51
Version 7.4-update52
Version 7.4-update53
Version 7.4-update54
Version 7.4-update55
Version 7.4-update56
Version 7.4-update57
Version 7.4-update58
Version 7.4-update59
Version 7.4-update60
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal