GHSA-wgqm-qp44-cg6x
Incorrect Default Permissions in Liferay Portal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | >= 7.4.1, < 7.4.3.5 | 7.4.3.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
References
External links from the advisory. They lead to third-party sites.