Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-pw7p-3648-qqmg
Advisory ID github_osv/GHSA-pw7p-3648-qqmg
Aliases CVE-2024-25604
Summary Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions does not properly check user permissions, which allows remote authenticated users with the VIEW user permission to edit their own permission via the User and Organizations section of the Control Panel.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-863 Incorrect Authorization
System Score Found at
cvssv3.1 6.5 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-pw7p-3648-qqmg/GHSA-pw7p-3648-qqmg.json
generic_textual MODERATE
Reference id Reference type URL
https://github.com/liferay/liferay-portal
https://github.com/liferay/liferay-portal/commit/4a196df20e180be76944cd0c623df486379d7724
https://github.com/liferay/liferay-portal/commit/f028316fa975d2e13bed7ef49d69ab77f412765e
CVE-2024-25604 https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25604
CVE-2024-25604 https://nvd.nist.gov/vuln/detail/CVE-2024-25604
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-pw7p-3648-qqmg/GHSA-pw7p-3648-qqmg.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-21T18:38:45Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/25xxx/CVE-2024-25604.json

Source Advisory: vulnrichment/CVE-2024-25604

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]