CVE-2022-39975

MediumCVSS 4.3/10Last modified Jul 9, 2026

Description

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-399769.8School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/CVE-2022-399777.2Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the User module. Th CVE-2022-399787.2Online Pet Shop We App v1.0 was discovered to contain an arbitrary file upload vulnerability via the Editing function in the Product List mo CVE-2022-39989.8A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.p CVE-2022-399839.8File upload vulnerability in Pro Gamma Instant Developer RD3 22.5 r23, r30, and possibly earlier versions, allows attackers to execute arbit CVE-2022-399869.8A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id p CVE-2022-399878.8A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via t CVE-2022-399885.4A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payloa CVE-2022-399899.8An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administr CVE-2022-39998.1The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authent CVE-2022-399964.8Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to CVE-2022-399978.0A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges