Threats tagged 'ghsa-j82q-c85j-xw4w'

Liferay Portal and DXP versions prior to 6.0.26 do not properly restrict access to the OpenAPI YAML file under certain conditions. This vulnerability allows remote attackers to access the OpenAPI specification via a crafted URL, potentially exposing sensitive API information. The issue affects multiple versions including Liferay Portal 7.4.0 through 7.4.3.109, Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. A fix is available in version 6.0.26.