Liferay Portal and DXP Insecure Direct Object Reference Vulnerability in Contacts Center Widget

An insecure direct object reference (IDOR) vulnerability has been identified in the Contacts Center widget of Liferay Portal and Liferay DXP. This vulnerability allows remote attackers to access contact information, including names and email addresses, by exploiting the '_com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId' parameter. The issue affects Liferay Portal versions 7.4.0 to 7.4.3.119, as well as several Liferay DXP versions, including 2023.Q4.0 to 2023.Q4.6, 2023.Q3.1 to 2023.Q3.10, 7.4 GA through update 92, and 7.3, along with older unsupported versions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to contact information within the Contacts Center widget, including names and email addresses.

Remediation

Users can upgrade to Liferay Portal 7.4.3.120, Liferay DXP 2024.Q2.0, Liferay DXP 2024.Q1.1, or Liferay DXP 2023.Q4.7 to address this vulnerability.