Description
The portlet configuration module in Liferay Portal 7.2.0 through 7.3.3 does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
Severity
Severity 2
Fixed Version(s)
- Liferay Portal 7.3.4
- May 2021 source patch for Liferay Portal 7.2.1. Details for working with source patches can be found on the Patching Liferay Portal page.
Publication date: Mon, 10 May 2021 16:00:00 +0000