CVE-2022-45320

MEDIUM

Liferay DXP <7.2 & Portal <7.4.3.16 - Authenticated Access Control Bypass via Wiki Ownership

Title source: llm
STIX 2.1

Description

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.

References (1)

Core 1

Scores

CVSS v3 6.3
EPSS 0.0036
EPSS Percentile 58.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (4)
com.liferay.portal/release.portal.bom 0 - 7.4.3.16Maven
liferay/digital_experience_platform 7.2 (27 CPE variants)
liferay/digital_experience_platform 7.3 (7 CPE variants)
liferay/digital_experience_platform 7.4 (15 CPE variants)
Published Feb 20, 2024
Tracked Since Feb 18, 2026