VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 20, 2024· Updated Aug 1, 2024

CVE-2024-25604

CVE-2024-25604

Description

Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.2.0, < 7.4.3.5-ga57.4.3.5-ga5
com.liferay.portal:release.dxp.bomMaven
< 7.2.10.fp177.2.10.fp17

Affected products

2

Patches

2
f028316fa975

LPS-141243 Add test

https://github.com/liferay/liferay-portalIstvan SajtosOct 27, 2021via ghsa
commit
1 file changed · +25 −0
  • modules/apps/user/user-test/src/testIntegration/java/com/liferay/user/service/permission/test/UserPermissionTest.java+25 −0 modified
    @@ -50,6 +50,31 @@ public class UserPermissionTest {
 	public static final AggregateTestRule aggregateTestRule =
 		new LiferayIntegrationTestRule();
 
+	@Test
+	public void testContainsPermissionsActionId() throws Exception {
+		_user1 = UserTestUtil.addUser();
+		_role = RoleTestUtil.addRole(RoleConstants.TYPE_REGULAR);
+
+		_userLocalService.addRoleUser(_role.getRoleId(), _user1);
+
+		PermissionChecker permissionChecker = _permissionCheckerFactory.create(
+			_user1);
+
+		Assert.assertFalse(
+			_userPermission.contains(
+				permissionChecker, _user1.getUserId(), null,
+				ActionKeys.PERMISSIONS));
+
+		RoleTestUtil.addResourcePermission(
+			_role, User.class.getName(), ResourceConstants.SCOPE_COMPANY,
+			String.valueOf(_user1.getCompanyId()), ActionKeys.PERMISSIONS);
+
+		Assert.assertTrue(
+			_userPermission.contains(
+				permissionChecker, _user1.getUserId(), null,
+				ActionKeys.PERMISSIONS));
+	}
+
 	@Test
 	public void testContainsViewActionId() throws Exception {
 		_user1 = UserTestUtil.addUser();
4a196df20e18

LPS-141243 Check properly if users are allowed to edit their own permissions

https://github.com/liferay/liferay-portalIstvan SajtosOct 22, 2021via ghsa
commit
1 file changed · +2 −1
  • portal-impl/src/com/liferay/portal/service/permission/UserPermissionImpl.java+2 −1 modified
    @@ -118,7 +118,8 @@ public boolean contains(
 				if (permissionChecker.hasOwnerPermission(
 						permissionChecker.getCompanyId(), User.class.getName(),
 						userId, contact.getUserId(), actionId) ||
-					(permissionChecker.getUserId() == userId) ||
+					((permissionChecker.getUserId() == userId) &&
+					 !actionId.equals(ActionKeys.PERMISSIONS)) ||
 					permissionChecker.hasPermission(
 						null, User.class.getName(), userId, actionId)) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.