IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-10-13 20:15

MODIFIED

2025-10-14 19:36

EPSS (Prob. Exploit)

0.31%

Top 76.4%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users to from one account to view addresses from a different account via the _com_liferay_account_admin_web_internal_portlet_AccountEntriesAdminPortlet_addressId parameter.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-3cm9-jrf5-h2cx MODERATE

Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.change.tracking.web

< 2.0.120

Fixed in: 2.0.120

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

8 versions affected

ALIASES:

GHSA-3cm9-jrf5-h2cx

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/10/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui