Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and DXP Publications Portlet Insecure Direct Object Reference Vulnerability

Vulnerability

An insecure direct object reference (IDOR) vulnerability has been identified in the Publications feature of Liferay Portal and Liferay DXP. This vulnerability allows remote authenticated attackers to access the edit page of a publication by manipulating the '_com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId' parameter. The issue affects Liferay Portal versions 7.3.1 through 7.4.3.111, as well as Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36.

Impact

Exploitation of this vulnerability allows for unauthorized access to the edit pages of publications, potentially leading to unauthorized modifications or management of publication content.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP 2024.Q1.1, 2023.Q4.6, or 2023.Q3.9 to address this vulnerability.

Added: Oct 13, 2025, 5:18 PM
Updated: Oct 13, 2025, 5:18 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.6
exploitability
4.8
remediation
7.7
relevance
0.7
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.