← Retour aux CVEs

CVE-2022-42132

MEDIUM

5.9

Description

The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.

Details CVE

Score CVSS v3.15.9

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteHIGH

Privileges requisNONE

Interaction utilisateurNONE

Publie11/15/2022

Derniere modification4/30/2025

Sourcenvd

Observations honeypot0

Produits affectes

liferay:digital_experience_platformliferay:liferay_portal

Faiblesses (CWE)

CWE-200CWE-200

References

http://liferay.com(cve@mitre.org)

https://issues.liferay.com/browse/LPE-17438(cve@mitre.org)

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132(cve@mitre.org)

http://liferay.com(af854a3a-2127-422b-91ae-364da2661108)

https://issues.liferay.com/browse/LPE-17438(af854a3a-2127-422b-91ae-364da2661108)

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.