Moderate severityNVD Advisory· Published Feb 20, 2024· Updated Aug 1, 2024
CVE-2024-25604
CVE-2024-25604
Description
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay.portal:release.portal.bomMaven | >= 7.2.0, < 7.4.3.5-ga5 | 7.4.3.5-ga5 |
com.liferay.portal:release.dxp.bomMaven | < 7.2.10.fp17 | 7.2.10.fp17 |
Affected products
4- ghsa-coords2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: >= 7.2.0, < 7.4.3.5-ga5
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-pw7p-3648-qqmgghsaADVISORY
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-25604ghsaADVISORY
- github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724ghsaWEB
- github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765eghsaWEB
News mentions
0No linked articles in our index yet.