Liferay Portal and Liferay DXP Menu Display Widget Unauthorized Information Exposure Vulnerability

A vulnerability exists in Liferay Portal versions 7.3.0 to 7.4.3.119, as well as in Liferay DXP versions 2023.Q3.1 to 2023.Q3.8, 2023.Q4.0 to 2023.Q4.5, 7.4 GA through update 92, and 7.3 GA through update 36. The issue arises in the Menu Display Widget, which improperly shows content to users without the necessary permissions. This flaw could lead to the unauthorized exposure of sensitive information.

Impact

Exploitation of this vulnerability could result in the unauthorized disclosure of sensitive information to users without the appropriate permissions.

Remediation

Users can upgrade to Liferay Portal 7.4.3.120 or Liferay DXP versions 2024.Q2.0, 2024.Q1.1, 2023.Q4.6, or 2023.Q3.9 to address this vulnerability.