CVE-2024-25148

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the "doAsUserId" URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a...

CVE-2024-25148

CVE-2024-25148 affects Liferay Portal versions 7.2.0–7.4.1 and certain Liferay DXP/older unsupported releases. The vulnerability stems from leakage of the doAsUserId URL parameter when creating linked content with the WYSIWYG editor and while impersonating a user, enabling remote authenticated us...

CVE-2024-25148: Insertion of Sensitive Information Into Sent Data

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the doAsUserId URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user...