CVE-2022-26595
- Source
- https://cve.org/CVERecord?id=CVE-2022-26595
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26595.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-26595
- Aliases
- Published
- 2022-04-19T12:52:20Z
- Modified
- 2026-07-15T01:48:52.286462965Z
- Summary
- [none]
- Details
-
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26595.json", "cna_assigner": "mitre" }- References
Affected packages
Git / github.com/liferay/liferay-portal
Affected ranges
- Type
- GIT
- Repo
- https://github.com/liferay/liferay-portal
- Events
-
IntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:liferay:liferay_portal:7.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:liferay:liferay_portal:7.4.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "extracted_events": [ { "introduced": "7.3.7" }, { "last_affected": "7.3.7" }, { "introduced": "7.4.0" }, { "last_affected": "7.4.0" }, { "introduced": "7.4.1" }, { "last_affected": "7.4.1" } ] }