Liferay Portal and DXP Display Page Template Authorization Bypass Vulnerability

An authorization check vulnerability has been identified in Liferay Portal versions 7.3.0 to 7.4.3.111, as well as in Liferay DXP versions 2023.Q4.0, 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35. This vulnerability allows remote attackers to view display page templates by sending crafted URLs, as the affected versions do not properly validate user permissions before granting access to these templates.

Impact

Exploitation of this vulnerability allows unauthorized users to view display page templates, potentially leading to exposure of sensitive information or unauthorized access to content.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, or 7.3 U36 to address this vulnerability.