CVE-2024-25148: Infoleak

Q: What is the severity of CVE-2024-25148?

CVE-2024-25148 is considered a moderate severity vulnerability due to the potential exposure of sensitive user information.

Q: How do I fix CVE-2024-25148?

To fix CVE-2024-25148, update your Liferay installation to the patched versions: 7.3.10.u4, 7.2.10.fp15, or 7.4.2.

Q: What versions are affected by CVE-2024-25148?

CVE-2024-25148 affects Liferay Portal versions 7.2.0 through 7.4.1, along with various unsupported older versions and specific versions of Liferay DXP.

Q: What is the impact of CVE-2024-25148?

The impact of CVE-2024-25148 involves potential leakage of the `doAsUserId` URL parameter during content creation when impersonating a user.

Q: Is CVE-2024-25148 limited to Liferay DXP?

No, CVE-2024-25148 also affects the Liferay Portal alongside certain versions of Liferay DXP.

Published Feb 8, 2024

Updated

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the doAsUserId URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.

Affected Software

37 affected componentsFixes available

maven/com.liferay.portal:release.dxp.bom>=7.3.0<7.3.10.u4

7.3.10.u4

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp15

7.2.10.fp15

maven/com.liferay.portal:release.portal.bom>=7.2.0<7.4.2

7.4.2

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_10

Liferay DXP=7.2-fix_pack_11

Liferay DXP=7.2-fix_pack_12

Liferay DXP=7.2-fix_pack_13

Liferay DXP=7.2-fix_pack_14

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay DXP=7.3-sp1

Liferay DXP=7.3-sp2

Liferay Liferay Portal>=7.2.0<=7.4.1

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.3.10.u4
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.2.10.fp15
Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.2

Event History

Feb 8, 2024

CVE Published

via MITRE·03:43 AM

Data Sourced

via MITRE·03:43 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·06:30 AM

Frequently Asked Questions

What is the severity of CVE-2024-25148?

CVE-2024-25148 is considered a moderate severity vulnerability due to the potential exposure of sensitive user information.

How do I fix CVE-2024-25148?