CVE-2024-25148CWE-201

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported…

Medium · published February 8, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2024-02-08T03:43Z
EPSS history
Timeline
  • 08 FEB 03:43Z
    In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported…
    cvelistv5