What is CVE-2022-42126?

CVE-2022-42126 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Improper Access Control. CVSS score: 4.3/10. Published 2022-11-15.

How severe is CVE-2022-42126?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Liferay Digital Experience Platform

CVE-2022-42126

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Liferay Digital_experience_platform — versions 7.3, 7.4
Liferay Liferay_portal
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

af854a3a-2127-422b-91ae-364da2661108 (Vendor Advisory)
cve@mitre.org (Vendor Advisory)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-42126?: CVE-2022-42126 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Improper Access Control. CVSS score: 4.3/10. Published 2022-11-15.
How severe is CVE-2022-42126?: Medium severity. CVSS v3 base score is 4.3 out of 10.