CVE-2022-45320: 
Java vulnerability analysis and mitigation

CVE-2022-45320 affects Liferay Portal and Liferay DXP systems, allowing remote authenticated users to become the owner of a wiki page by editing it. The vulnerability was discovered in multiple versions including Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16. This security issue was reported by Sompo Digital Lab Tel Aviv, specifically by Asaf Guterman (Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. This indicates that the vulnerability requires network access and low privileges to exploit, with no user interaction needed. The scope is unchanged, and it has low impact on confidentiality, integrity, and availability (NVD).

The vulnerability allows authenticated users to escalate their privileges specifically within the wiki functionality of Liferay systems. By exploiting this vulnerability, an attacker can become the owner of any wiki page simply by editing it, potentially leading to unauthorized control over wiki content (Vendor Advisory).

The vulnerability has been fixed in Liferay Portal 7.4.3.16, Liferay DXP 7.4 update 16, Liferay DXP 7.3 update 6, and Liferay DXP 7.2 fix pack 19. Organizations using affected versions should upgrade to these or later versions to mitigate the vulnerability (Vendor Advisory).