Liferay Portal and Liferay DXP Insecure Direct Object Reference Vulnerability Allowing Account Address Access

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Liferay Portal versions 7.4.3.4 through 7.4.3.111, as well as in Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92. This vulnerability allows remote authenticated users to access addresses from different accounts by exploiting the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

Impact

Exploitation of this vulnerability allows for unauthorized access to account addresses, potentially leading to privacy violations or misuse of personal information.

Remediation

Users can upgrade to Liferay Portal 7.4.3.113 or Liferay DXP 2024.Q1.1 or 2023.Q4.6 to address this vulnerability.