Liferay users can assign themselves to organizations, leading to
possible privilege escalation


Liferay Portal is an enterprise portal written in Java

Due to insufficient permission checking in the updateOrganizations
method of UserService any user
can assign hem or her self to any organization by issueing a single http request


It is common to grant special privileges to members of an organization.

Systems affected:

Liferay 6.1 ce
Liferay 6.1 ee
liferay 6.0.x

Vendor status :

Liferay was notified april 22 2012 by filing a bug in their public
bugtracker under issue number
LPS-26887. The issue has since been flagged as private and has been resolved.
Rate this post
Брой прочитания на тази страница: 1101
Liferay Portal 6.1 – 6.0.x Privilege Escalation

Вашият коментар

Вашият имейл адрес няма да бъде публикуван. Задължителните полета са отбелязани с *