GHSA-cx84-43xc-3gm2

Source

https://github.com/advisories/GHSA-cx84-43xc-3gm2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-cx84-43xc-3gm2/GHSA-cx84-43xc-3gm2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cx84-43xc-3gm2

Aliases

BIT-liferay-2022-42131
CVE-2022-42131

Published

2022-11-15T12:00:16Z

Modified

2023-12-06T01:02:40.293636Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Improper Certificate Validation in Liferay Portal

Details

Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.

Database specific

{
    "nvd_published_at": "2022-11-15T02:15:00Z",
    "github_reviewed_at": "2022-11-21T23:50:16Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-295"
    ]
}

References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name: com.liferay.portal:release.portal.bom; View open source insights on deps.dev
Purl: pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.1.0

Fixed

7.4.3.4

Affected versions

7.*

7.1.0

7.1.1

7.1.2

7.1.3

7.1.3-1

7.2.0

7.2.1

7.2.1-1

7.3.0

7.3.0-1

7.3.1

7.3.1-1

7.3.2

7.3.2-1

7.3.3

7.3.3-1

7.3.4

7.3.5

7.3.6

7.3.7

7.4.0

7.4.1

7.4.1-1

7.4.2

7.4.2-1