Liferay Portal and DXP Email Verification Bypass Vulnerability Allowing API Access and Content Modification

A vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.109, older unsupported versions, and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. This vulnerability allows remote users to access and edit content via the API, as the system does not restrict API access before a user has verified their email address.

Impact

Exploitation of this vulnerability allows for unauthorized access to APIs, enabling remote users to access and modify content through the API.

Remediation

Users can upgrade to Liferay Portal 7.4.3.110, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, or Liferay DXP 7.3 Update 36.