GHSA-mc8m-4r3w-q2hw

Source

https://github.com/advisories/GHSA-mc8m-4r3w-q2hw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-mc8m-4r3w-q2hw/GHSA-mc8m-4r3w-q2hw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mc8m-4r3w-q2hw

Aliases

CVE-2022-45320

Published

2024-02-20T06:30:29Z

Modified

2025-03-31T13:42:24Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Privilege escalation in Liferay Portal

Details

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.

Database specific

{
    "cwe_ids":  [
        "CWE-284"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-12T21:58:35Z",
    "nvd_published_at":  "2024-02-20T05:15:07Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name: com.liferay.portal:release.portal.bom; View open source insights on deps.dev
Purl: pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.4.3.16

Affected versions

7.*

7.0.6

7.0.6-1

7.0.6-2

7.1.0

7.1.1

7.1.2

7.1.3

7.1.3-1

7.2.0

7.2.1

7.2.1-1

7.3.0

7.3.0-1

7.3.1

7.3.1-1

7.3.2

7.3.2-1

7.3.3

7.3.3-1

7.3.4

7.3.5

7.3.6

7.3.7

7.4.0

7.4.1

7.4.1-1

7.4.2

7.4.2-1

7.4.3.4

7.4.3.5

7.4.3.6

7.4.3.7

7.4.3.8

7.4.3.9

7.4.3.10

7.4.3.11

7.4.3.12

7.4.3.13

7.4.3.14

7.4.3.15

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-mc8m-4r3w-q2hw/GHSA-mc8m-4r3w-q2hw.json"