-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commits, particularly 1ab3de8142d9201d10d89f5eeb1edeea64599d57 and f07339e42a5788aa44016c4ca566b92399643442, clearly points to an Insecure Direct Object Reference (IDOR) vulnerability in the getSearchContainer method of the EditRolesUsersDisplayContext class. The vulnerability description states that the groupId parameter in _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId is vulnerable. The code changes in the patch directly address this by adding a crucial permission check. Specifically, the GroupPermissionUtil.contains call is added to verify that the user making the request has the ASSIGN_USER_ROLES permission for the groupId they are trying to access. Before this fix, the absence of this check allowed an organization administrator to manipulate the groupId and view users from other organizations, which they were not authorized to see. The vulnerable function, getSearchContainer, was directly responsible for processing this malicious input and returning the unauthorized data. The added test cases in commit 830140e15ccfeb105641681c4f2bb375c12582ba further confirm this scenario by simulating the exact attack and verifying that the fix prevents it.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.roles.selector.web | maven | < 5.0.32 | 5.0.32 |
Ongoing coverage of React2Shell