LSV-1103: User permissions are not checked for DepotGroupItemSelectorProvider

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: None
• Component/s: None
• Labels:
  • 7.3.10-u8
• CVE IDs: CVE-2022-42126
• CVSS Base Score: 4.3
• CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• 7.3 Fix Pack Version: 8
• 7.4 Fix Pack Version: 29

The Asset Libraries module in Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI.