The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.
{ "cpes": [ "cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*", "cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*" ], "severity": "Medium" }