Liferay Portal and Liferay DXP Insecure Default Site Membership Vulnerability

A vulnerability exists in Liferay Portal versions 7.1.0 to 7.4.3.111, as well as in Liferay DXP 2023.Q4.0, 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. The issue arises because the default membership type for newly created sites is set to 'Open', allowing any registered user to join the site. This could enable a remote attacker with site membership to view, add, or edit content on the site.

Impact

Exploitation of this vulnerability could lead to unauthorized content management on affected sites, including viewing, adding, or editing content.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP versions 2024.Q1.1, 2023.Q4.1, 2023.Q3.5, or 7.3 U36 to address this vulnerability.