Authenticated users have site member permission in global and personal site

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.0 DE (7.0.10), 7.1
• Fix Version/s: 7.0.X EE, 7.1.x EE
• Component/s: Application Security > Permissions, Security Vulnerability
• Labels:
  • liferay-fixpack-de-66-7010
  • liferay-fixpack-dxp-1-7110
  • lsv
  • lsv-400
  • sev-3
• Business Value: 3

Liferay DXP 7.1 and DXP 7.0 does not properly verify permission of authenticated users and grants site member permissions to authenticated users in the global site and the user's personal site.