CVE-2022-42127

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36 and Liferay DXP 7.4 update 1 through 36 does not properly validate user permissions when accessing friendly URL history. This flaw enables remote attackers to view the complete history of all friendly URLs assigned to a page, which may expose sensitive information about page revisions or configuration changes.

An attacker can exploit this vulnerability remotely without authentication by sending crafted requests to the affected module. The lack of proper permission checks means that any user, regardless of role, can enumerate the friendly URL assignments and their historical records. No special network position or privileges are required, making the attack surface broad [1].

Successful exploitation allows an attacker to obtain a list of all friendly URLs that have ever been assigned to any page on the system. This information leakage could aid in mapping the site structure, identifying renamed or deleted pages, and potentially uncovering administrative or sensitive areas based on URL patterns.

As of the publication date, no patch or workaround has been announced for this vulnerability. Organizations running the affected versions should consider applying any available updates from Liferay and monitor for an official fix. The confidentiality impact is high due to the exposure of historical URL data, though the integrity and availability of the system remain unaffected.