5.3

CVE-2025-62252 Assign user from another instance to an organization

Description

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

Severity

5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N)

Affected Version(s)

  • Liferay Portal 7.1.0 through 7.4.3.111
  • Liferay DXP 2023.Q4.0 through 2023.Q4.5
  • Liferay DXP 2023.Q3.1 through 2023.Q3.10
  • Liferay DXP 7.4, and older unsupported versions

Are you new to Liferay? Found Liferay and want to know what it can do for you? Or are you with Liferay and still remember the time when you were new and unexperienced? Where did you come from and what was the biggest problem you faced? Can you ever learn enough? And how do you keep up with the current trends and new features?

Fixed Version(s)

A platform as big as Liferay spans several technologies and areas of best practices that are beneficial to know of. Nobody can know everything - there's always a learning curve. At the beginning, it's quite steep. Some argue that it's flattening the more you know. Some argue that it gets steeper: The more you know, the more you know what you don't know.

I'd like to give you pointers to resources that are available to you, in order to learn about Liferay, resources that help you avoid steep detours, when there are flatter direct connections. This is meant to be (eventually) comprehensive but I'm sure that it will never be complete. It's just what I remember while I write this article and the follow ups (yes, there are more, already drafted)

User Guide

Have you ever read Liferay's User Guide? Whatever you answer, my prediction is that you don't know what's in there today - if only because it's constantly updated. As a regular user of Liferay, no matter what your role is, you probably need to know several of the chapters outlined in that guide. It's covering anything from Content- and User-Management, Installation, Dealing with Plugins etc.

It's worth checking it out, even if you have some experience developing with Liferay. After all: When you know about a feature being available in Liferay, you can just use it instead of implementing it yourself. Every built in feature that you use, you don't have to write & maintain yourself. Remember that story from chapter 1 - the training participants that only took Mastering Liferay fundamentals training years after their project started? Same reasons here.

Acknowledgments

This issue was reported by foobar7

Publication Date: 

November 6, 2024

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!