CVE-2022-39975: Liferay Portal Missing Authorization vulnerability
Summary
CVE-2022-39975: Liferay Portal Missing Authorization vulnerability. Affects com.liferay.portal:release.portal.bom versions >= 7.3.3, < 7.4.3.35. Fixed in 7.4.3.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is an open-source enterprise portal platform that provides a unified user experience for building and managing web applications. It offers various features such as content management, collaboration, and social networking. The affected package, com.liferay.portal:release.portal.bom, is a Maven package that includes the necessary dependencies for Liferay Portal. This vulnerability affects Liferay Portal versions 7.3.3 through 7.4.3.34, Liferay DXP 7.3 before update 10, and 7.4 before update 35.
Vulnerability Detail
The vulnerability in the Layout module of Liferay Portal allows attackers to view unpublished "Content Page" pages by manipulating the URL. The module fails to check user permissions before displaying the preview of a "Content Page" type page. This oversight enables unauthorized users to access and view sensitive information that should remain unpublished. The impact of this vulnerability can be significant, as it compromises the confidentiality of unpublished content and may lead to unauthorized disclosure of sensitive information.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.35
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the preview functionality for "Content Page" type pages. This can be achieved by modifying the configuration settings of the Layout module. However, this workaround may impact the user experience and should only be considered until the appropriate update can be applied.
Conclusion
The missing authorization vulnerability in Liferay Portal's Layout module exposes unpublished "Content Page" pages to unauthorized access. It is crucial to update Liferay Portal to the latest version (7.4.3.35 or later) to mitigate this vulnerability. In the meantime, users can consider implementing the provided workaround to limit the exposure of sensitive information. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
Liferay Portal is an open-source enterprise portal platform that provides a unified user experience for building and managing web applications.
Liferay Portal versions 7.3.3 through 7.4.3.34, Liferay DXP 7.3 before update 10, and 7.4 before update 35 are affected.
This vulnerability allows unauthorized users to view unpublished "Content Page" pages, potentially leading to the unauthorized disclosure of sensitive information.
To fix this vulnerability, update Liferay Portal to version 7.4.3.35 or later and follow the provided upgrade instructions.
Yes, users can temporarily disable the preview functionality for "Content Page" type pages until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
