CVE-2023-3426
Published: 02 August 2023
Summary
CVE-2023-3426 is a medium-severity Forced Browsing (CWE-425) vulnerability in Liferay Digital Experience Platform. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 36.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-44092
Vulnerability details
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.
Always invoking the reference monitor prevents missing authorization checks for protected resources.
Requiring enforcement of authorizations ensures checks are performed rather than omitted for resources.
Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.
Prevents missing authorization checks for input operations by restricting the capability itself.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.