CVE-2022-42128 in Liferay
Summary
by MITRE • 11/15/2022
The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2026
The vulnerability identified as CVE-2022-42128 affects the Hypermedia REST APIs module within Liferay Portal versions 7.4.1 through 7.4.3.4 and Liferay DXP 7.4 GA, representing a critical access control flaw that undermines the security posture of enterprise content management systems. This issue manifests through improper permission validation within the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API endpoint, which should have enforced strict authorization checks before exposing sensitive wiki node objects to remote attackers. The flaw exists in the core authentication and authorization framework of the platform, specifically in how it processes external reference code lookups for wiki nodes within site contexts.
The technical implementation of this vulnerability stems from insufficient input validation and access control enforcement mechanisms within the REST API layer. When attackers make requests to the getSiteWikiNodeByExternalReferenceCode endpoint, the system fails to verify whether the requesting user possesses adequate permissions to access the specific wiki node object referenced by the external code. This creates a privilege escalation scenario where unauthorized users can bypass normal access controls and retrieve wiki node information that should be restricted to authorized personnel. The vulnerability operates at the application layer and leverages the existing API interface to exploit the missing authorization checks, making it particularly dangerous as it requires no special privileges beyond basic network access to the platform.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to gather detailed information about wiki node structures, potentially including sensitive content, user permissions, and organizational data stored within the wiki system. This reconnaissance capability can serve as a foundation for further attacks, allowing threat actors to map the content management environment and identify additional targets for exploitation. The vulnerability affects organizations using Liferay Portal or DXP in enterprise environments where wiki nodes contain confidential information, making it particularly concerning for compliance-sensitive industries that must maintain strict data access controls and audit trails. The exposure of wiki node objects could lead to data leakage, insider threat scenarios, and potential compromise of other system components that rely on wiki content for operational purposes.
Organizations affected by this vulnerability should implement immediate mitigations including applying the vendor-provided patches or updates that address the permission validation flaw in the Hypermedia REST APIs module. The fix typically involves strengthening the authorization checks within the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode endpoint to ensure proper validation of user permissions before returning any wiki node objects. Network-level controls such as API rate limiting and monitoring of suspicious API access patterns can provide additional defensive layers while permanent fixes are deployed. Security teams should also conduct comprehensive audits of their Liferay installations to identify any other potentially vulnerable API endpoints and ensure proper access control mechanisms are in place across the entire platform. This vulnerability aligns with CWE-285, which addresses improper authorization in software systems, and represents a clear violation of the principle of least privilege that should be enforced at all API endpoints within enterprise applications. The ATT&CK framework categorizes this as a privilege escalation technique through API abuse, where attackers leverage legitimate application interfaces to access unauthorized resources.