CVE-2022-42128

Vulnerability

Description The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA does not properly validate permissions when processing requests to the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API. This flaw allows an unauthenticated remote attacker to bypass access controls and retrieve a WikiNode object without proper authorization [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to the affected API endpoint. No authentication or prior knowledge of the system is required, as the permission check is missing entirely. The attack is remotely exploitable over the network and does not require any special privileges or user interaction [1].

Impact

Successful exploitation enables the attacker to obtain WikiNode objects, which may contain sensitive configuration data, internal notes, or other information that could aid in further attacks. The exposure of such objects violates the principle of least privilege and could lead to escalation of access within the Liferay instance [1].

Mitigation

As of the publication date, no patch or workaround has been officially announced by Liferay. Users are advised to monitor vendor advisories and apply any security updates as soon as they become available [1].