CVE-2022-42126: Medium severity Liferay Digital Experience Platform vulnerability
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.48
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-42126.
What is the severity level of CVE-2022-42126?
The severity level of CVE-2022-42126 is medium with a severity value of 4.3.
Which versions of Liferay Portal and Liferay DXP are affected by CVE-2022-42126?
CVE-2022-42126 affects Liferay Portal versions 7.3.5 through 7.4.3.28, Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29.
How does CVE-2022-42126 impact remote authenticated users?
CVE-2022-42126 allows remote authenticated users to view asset libraries via the UI.
Are there any references for CVE-2022-42126?
Yes, you can find references for CVE-2022-42126 on the following links: [Liferay](http://liferay.com), [Liferay Issue Tracker](https://issues.liferay.com/browse/LPE-17593), [Liferay Security Advisories](https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126).