IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-12 03:15

MODIFIED

2025-09-15 15:22

EPSS (Prob. Exploit)

0.27%

Top 82.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-v53g-736w-mgw4 MODERATE

Liferay Portal's Organization Selector exposes organization data to remote authenticated users

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.organizations.item.selector.web

>= 4.0.2, < 4.0.22

Fixed in: 4.0.22

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-v53g-736w-mgw4

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/09/2025 03:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui