CVE-2022-42132
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In Liferay Portal and DXP, the Test LDAP Users functionality exposes LDAP credentials in the page URL when paginating through the user list. Man-in-the-middle attackers or those with access to request logs can capture these credentials.
Risk Assessment
The risk involves leakage of sensitive LDAP credentials, potentially allowing unauthorized access to directory services and further privilege escalation within the organization.
Recommendation
Immediately upgrade Liferay Portal to version 7.4.3.5 or later, and Liferay DXP to the appropriate fix pack as specified in the security advisory.
Original NVD description (English source)
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.