-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.change.tracking.web | maven | < 2.0.120 | 2.0.120 |
JavaJavaMiggo AIRoot Cause AnalysisThe analysis of the provided patches reveals vulnerabilities within the com.liferay.change.tracking.web module, specifically in the UpdateCTCommentMVCResourceCommand.doServeResource method. The patches fix both a CSRF vulnerability and an improper access control issue. It is important to note that the provided CVE description refers to an Insecure Direct Object Reference (IDOR) vulnerability in a different module (com.liferay.account.admin.web) and is associated with a different internal issue tracker ID (LPE-17932 vs. LPD-15347 in the commits). Therefore, the identified vulnerable function and the reasoning are based strictly on the provided commit data, which appears to be for a different vulnerability than the one described in the CVE title and description. The root cause of the vulnerability fixed by the patches is a combination of missing CSRF protection and inadequate permission checks, allowing unauthorized modification of data.
com.liferay.change.tracking.web.internal.portlet.action.UpdateCTCommentMVCResourceCommand.doServeResourcemodules/apps/change-tracking/change-tracking-web/src/main/java/com/liferay/change/tracking/web/internal/portlet/action/UpdateCTCommentMVCResourceCommand.java
Ongoing coverage of React2Shell