What’s Vulnerable › Vulnerabilities

CVE-2024-25148

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-08 · updated 2026-06-17
• Weakness: CWE-201

Description

In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.

Affected products

• Liferay Digital Experience Platform: 7.2, 7.2-fix_pack_1, 7.2-fix_pack_10, 7.2-fix_pack_11, 7.2-fix_pack_12, 7.2-fix_pack_13 (+9)
• Liferay DXP: 7.3, 7.3-sp1, 7.3-sp2
• Liferay Portal: from 7.2.0 through 7.4.1

References

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25148

Get alerted when CVE-2024-25148 or the next vulnerability affects your stack