PT-2024-20781 · Liferay · Liferay Portal+1

Published 2024-02-08 · Updated 2024-10-02 · CVE-2024-25148

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.1 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 15

Description The doAsUserId URL parameter may be leaked when creating linked content using the WYSIWYG editor while impersonating a user. This could allow remote authenticated users to impersonate a user after accessing the linked content.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.1, update to a version that includes the fix for the doAsUserId parameter leak. For Liferay DXP 7.3, apply service pack 3 or later to address the issue. For Liferay DXP 7.2, apply fix pack 15 or later to resolve the problem. As a temporary workaround, consider restricting access to the WYSIWYG editor when impersonating a user to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

CVE-2024-25148

GHSA-QWJ8-QGPR-8CRM

Affected Products

Liferay Dxp

Liferay Portal

References · 6

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25148 · Security Note
• https://osv.dev/vulnerability/GHSA-qwj8-qgpr-8crm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25148 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/70573 · Telegram Post