Lucene search
PRIOn knowledge basePRION:CVE-2024-25148HistoryFeb 08, 2024 - 4:15 a.m.
Code injection
2024-02-0804:15:00
PRIOn knowledge base
www.prio-n.com
3
liferay portal
code injection
vulnerability
user impersonation
wysiwyg editor
remote authenticated users
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the doAsUserId URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dxp | eq | 7.2 fixpack2 | |
| dxp | eq | 7.2 fixpack3 | |
| dxp | eq | 7.2 fixpack4 | |
| dxp | eq | 7.2 fixpack5 | |
| dxp | eq | 7.2 fixpack1 | |
| dxp | eq | 7.2 | |
| dxp | eq | 7.2 fixpack6 | |
| dxp | eq | 7.2 fixpack7 | |
| dxp | eq | 7.2 fixpack8 | |
| dxp | eq | 7.2 fixpack9 |
Related
osv
osv
Liferay Portal vulnerable to user impersonation
2024-02-08 06:30:23
CVE-2024-25148
2024-02-08 04:15:08
nvd
nvd
CVE-2024-25148
2024-02-08 04:15:08
veracode
veracode
Sensitive Information Exposure
2024-02-09 09:19:50
github
github
Liferay Portal vulnerable to user impersonation
2024-02-08 06:30:23
cvelist
cvelist
CVE-2024-25148
2024-02-08 03:43:14
cve
cve
CVE-2024-25148
2024-02-08 04:15:08