CVE-2022-42126

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-15 · updated 2026-07-09
Weakness: CWE-284

Description

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.

Affected products

Liferay Digital Experience Platform: 7.3, 7.4, 7.4-update1
Liferay Portal: from 7.3.5 before 7.4.3.29 — fixed in 7.4.3.29

How to fix

Upgrade to a fixed version: Liferay Portal 7.4.3.29. Check the vendor advisory for mitigations.

References

https://issues.liferay.com/browse/LPE-17593
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126
https://issues.liferay.com/browse/LPE-17593
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126

Get alerted when CVE-2022-42126 or the next vulnerability affects your stack