Improper privilege management in Liferay Enterprise Portal - #VU8553
Published: September 21, 2017
Vulnerability identifier: #VU8553
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to an error when editing blog entry. The application may reset the blog entry's permission to the default permission. This may allow a user without the necessary permission to view a blog entry.
Affected software
Liferay Enterprise Portal
Remediation
Update to version 7.0.2 CE GA3.