LSV-450: Marketplace is accessible to any user who with the update page permission

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 7.0 DE (7.0.10), 7.1 DXP (7.1.10)
• Fix Version/s: None
• Component/s: App Management, Security Vulnerability
• Labels:
  • lsv
  • lsv-450
  • sev-2

In DXP 7.1 and DXP 7.0, any user with permission to update a page can add the Marketplace widget to a page via URL manipulation and install a marketplace application.