Liferay Portal and Liferay DXP Batch Engine Permission Vulnerability Allowing Unauthorized Data Access

A vulnerability exists in the Batch Engine of Liferay Portal versions 7.4.0 to 7.4.3.112, as well as in Liferay DXP versions 2023.Q4.0 to 2023.Q4.7, 2023.Q3.1 to 2023.Q3.10, and 7.4 GA through update 92. This vulnerability arises because the Batch Engine does not adequately verify permissions for import and export tasks. As a result, remote authenticated users can access exported data through the REST APIs.

Impact

Exploitation of this vulnerability allows for unauthorized access to exported data via the REST APIs.

Remediation

Users can upgrade to Liferay Portal 7.4.3.113, Liferay DXP 2024.Q2.0, Liferay DXP 2024.Q1.1, or Liferay DXP 2023.Q4.8 to address this vulnerability.