PT-2022-26279 · Liferay · Liferay Portal+1

Published 2022-11-15 · Updated 2025-04-30 · CVE-2022-42132

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.4.3.4 Liferay DXP 7.0 fix pack 102 and earlier Liferay DXP 7.1 before fix pack 27 Liferay DXP 7.2 before fix pack 17 Liferay DXP 7.3 before update 4 Liferay DXP 7.4 GA

Description The Test LDAP Users functionality includes the LDAP credential in the page URL when paginating through the list of users. This allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.

Recommendations For Liferay Portal versions 7.0.0 through 7.4.3.4, update to a version later than 7.4.3.4 to resolve the issue. For Liferay DXP 7.0, apply fix pack 103 or later. For Liferay DXP 7.1, apply fix pack 27 or later. For Liferay DXP 7.2, apply fix pack 17 or later. For Liferay DXP 7.3, apply update 4 or later. For Liferay DXP 7.4, update to a version later than 7.4 GA. As a temporary workaround, consider restricting access to the Test LDAP Users functionality until a patch is available.

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

BIT-LIFERAY-2022-42132

CVE-2022-42132

GHSA-F43M-HHJ4-Q3JG

Affected Products

Liferay Dxp

Liferay Portal

References · 15

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f43m-hhj4-q3jg · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17438 · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42132 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42132 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2022-42132 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d · Note
• https://github.com/liferay/liferay-portal/commit/b6cff511119d71dea38f5485761730f4fb5d4430 · Note
• https://web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132 · Note
• https://t.me/cibsecurity/52993 · Telegram Post
• https://t.me/cvenotify/37718 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/120329 · Telegram Post