Lucene search

[email protected]CVE-2022-42132

HistoryNov 15, 2022 - 2:15 a.m.

CVE-2022-42132

2022-11-1502:15:12

CWE-200

[email protected]

web.nvd.nist.gov

cve-2022-42132

liferay portal

liferay dxp

ldap

security vulnerability

man-in-the-middle攂攂攂

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.2%

JSON

The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.

Affected configurations

NVD

Node

liferaydigital_experience_platformMatch7.0-

liferaydigital_experience_platformMatch7.0fix_pack_1

liferaydigital_experience_platformMatch7.0fix_pack_10

liferaydigital_experience_platformMatch7.0fix_pack_100

liferaydigital_experience_platformMatch7.0fix_pack_11

liferaydigital_experience_platformMatch7.0fix_pack_12

liferaydigital_experience_platformMatch7.0fix_pack_13

liferaydigital_experience_platformMatch7.0fix_pack_14

liferaydigital_experience_platformMatch7.0fix_pack_15

liferaydigital_experience_platformMatch7.0fix_pack_16

liferaydigital_experience_platformMatch7.0fix_pack_17

liferaydigital_experience_platformMatch7.0fix_pack_18

liferaydigital_experience_platformMatch7.0fix_pack_19

liferaydigital_experience_platformMatch7.0fix_pack_2

liferaydigital_experience_platformMatch7.0fix_pack_20

liferaydigital_experience_platformMatch7.0fix_pack_21

liferaydigital_experience_platformMatch7.0fix_pack_22

liferaydigital_experience_platformMatch7.0fix_pack_23

liferaydigital_experience_platformMatch7.0fix_pack_24

liferaydigital_experience_platformMatch7.0fix_pack_25

liferaydigital_experience_platformMatch7.0fix_pack_26

liferaydigital_experience_platformMatch7.0fix_pack_27

liferaydigital_experience_platformMatch7.0fix_pack_28

liferaydigital_experience_platformMatch7.0fix_pack_29

liferaydigital_experience_platformMatch7.0fix_pack_3

liferaydigital_experience_platformMatch7.0fix_pack_30

liferaydigital_experience_platformMatch7.0fix_pack_31

liferaydigital_experience_platformMatch7.0fix_pack_32

liferaydigital_experience_platformMatch7.0fix_pack_33

liferaydigital_experience_platformMatch7.0fix_pack_34

liferaydigital_experience_platformMatch7.0fix_pack_35

liferaydigital_experience_platformMatch7.0fix_pack_36

liferaydigital_experience_platformMatch7.0fix_pack_37

liferaydigital_experience_platformMatch7.0fix_pack_38

liferaydigital_experience_platformMatch7.0fix_pack_39

liferaydigital_experience_platformMatch7.0fix_pack_4

liferaydigital_experience_platformMatch7.0fix_pack_40

liferaydigital_experience_platformMatch7.0fix_pack_41

liferaydigital_experience_platformMatch7.0fix_pack_42

liferaydigital_experience_platformMatch7.0fix_pack_43

liferaydigital_experience_platformMatch7.0fix_pack_44

liferaydigital_experience_platformMatch7.0fix_pack_45

liferaydigital_experience_platformMatch7.0fix_pack_46

liferaydigital_experience_platformMatch7.0fix_pack_47

liferaydigital_experience_platformMatch7.0fix_pack_48

liferaydigital_experience_platformMatch7.0fix_pack_49

liferaydigital_experience_platformMatch7.0fix_pack_5

liferaydigital_experience_platformMatch7.0fix_pack_50

liferaydigital_experience_platformMatch7.0fix_pack_51

liferaydigital_experience_platformMatch7.0fix_pack_52

liferaydigital_experience_platformMatch7.0fix_pack_53

liferaydigital_experience_platformMatch7.0fix_pack_54

liferaydigital_experience_platformMatch7.0fix_pack_55

liferaydigital_experience_platformMatch7.0fix_pack_56

liferaydigital_experience_platformMatch7.0fix_pack_57

liferaydigital_experience_platformMatch7.0fix_pack_58

liferaydigital_experience_platformMatch7.0fix_pack_59

liferaydigital_experience_platformMatch7.0fix_pack_6

liferaydigital_experience_platformMatch7.0fix_pack_60

liferaydigital_experience_platformMatch7.0fix_pack_61

liferaydigital_experience_platformMatch7.0fix_pack_62

liferaydigital_experience_platformMatch7.0fix_pack_63

liferaydigital_experience_platformMatch7.0fix_pack_64

liferaydigital_experience_platformMatch7.0fix_pack_65

liferaydigital_experience_platformMatch7.0fix_pack_66

liferaydigital_experience_platformMatch7.0fix_pack_67

liferaydigital_experience_platformMatch7.0fix_pack_68

liferaydigital_experience_platformMatch7.0fix_pack_69

liferaydigital_experience_platformMatch7.0fix_pack_7

liferaydigital_experience_platformMatch7.0fix_pack_70

liferaydigital_experience_platformMatch7.0fix_pack_71

liferaydigital_experience_platformMatch7.0fix_pack_72

liferaydigital_experience_platformMatch7.0fix_pack_73

liferaydigital_experience_platformMatch7.0fix_pack_74

liferaydigital_experience_platformMatch7.0fix_pack_75

liferaydigital_experience_platformMatch7.0fix_pack_76

liferaydigital_experience_platformMatch7.0fix_pack_77

liferaydigital_experience_platformMatch7.0fix_pack_78

liferaydigital_experience_platformMatch7.0fix_pack_79

liferaydigital_experience_platformMatch7.0fix_pack_8

liferaydigital_experience_platformMatch7.0fix_pack_80

liferaydigital_experience_platformMatch7.0fix_pack_81

liferaydigital_experience_platformMatch7.0fix_pack_82

liferaydigital_experience_platformMatch7.0fix_pack_83

liferaydigital_experience_platformMatch7.0fix_pack_84

liferaydigital_experience_platformMatch7.0fix_pack_85

liferaydigital_experience_platformMatch7.0fix_pack_86

liferaydigital_experience_platformMatch7.0fix_pack_87

liferaydigital_experience_platformMatch7.0fix_pack_88

liferaydigital_experience_platformMatch7.0fix_pack_89

liferaydigital_experience_platformMatch7.0fix_pack_9

liferaydigital_experience_platformMatch7.0fix_pack_90

liferaydigital_experience_platformMatch7.0fix_pack_91

liferaydigital_experience_platformMatch7.0fix_pack_92

liferaydigital_experience_platformMatch7.0fix_pack_93

liferaydigital_experience_platformMatch7.0fix_pack_94

liferaydigital_experience_platformMatch7.0fix_pack_95

liferaydigital_experience_platformMatch7.0fix_pack_96

liferaydigital_experience_platformMatch7.0fix_pack_97

liferaydigital_experience_platformMatch7.0fix_pack_98

liferaydigital_experience_platformMatch7.0fix_pack_99

liferaydigital_experience_platformMatch7.1-

liferaydigital_experience_platformMatch7.1fix_pack_1

liferaydigital_experience_platformMatch7.1fix_pack_10

liferaydigital_experience_platformMatch7.1fix_pack_11

liferaydigital_experience_platformMatch7.1fix_pack_12

liferaydigital_experience_platformMatch7.1fix_pack_13

liferaydigital_experience_platformMatch7.1fix_pack_14

liferaydigital_experience_platformMatch7.1fix_pack_15

liferaydigital_experience_platformMatch7.1fix_pack_16

liferaydigital_experience_platformMatch7.1fix_pack_17

liferaydigital_experience_platformMatch7.1fix_pack_18

liferaydigital_experience_platformMatch7.1fix_pack_19

liferaydigital_experience_platformMatch7.1fix_pack_2

liferaydigital_experience_platformMatch7.1fix_pack_20

liferaydigital_experience_platformMatch7.1fix_pack_21

liferaydigital_experience_platformMatch7.1fix_pack_22

liferaydigital_experience_platformMatch7.1fix_pack_23

liferaydigital_experience_platformMatch7.1fix_pack_24

liferaydigital_experience_platformMatch7.1fix_pack_25

liferaydigital_experience_platformMatch7.1fix_pack_26

liferaydigital_experience_platformMatch7.1fix_pack_3

liferaydigital_experience_platformMatch7.1fix_pack_4

liferaydigital_experience_platformMatch7.1fix_pack_5

liferaydigital_experience_platformMatch7.1fix_pack_6

liferaydigital_experience_platformMatch7.1fix_pack_7

liferaydigital_experience_platformMatch7.1fix_pack_8

liferaydigital_experience_platformMatch7.1fix_pack_9

liferaydigital_experience_platformMatch7.1sp1

liferaydigital_experience_platformMatch7.2-

liferaydigital_experience_platformMatch7.2fix_pack_1

liferaydigital_experience_platformMatch7.2fix_pack_10

liferaydigital_experience_platformMatch7.2fix_pack_11

liferaydigital_experience_platformMatch7.2fix_pack_12

liferaydigital_experience_platformMatch7.2fix_pack_13

liferaydigital_experience_platformMatch7.2fix_pack_14

liferaydigital_experience_platformMatch7.2fix_pack_15

liferaydigital_experience_platformMatch7.2fix_pack_16

liferaydigital_experience_platformMatch7.2fix_pack_2

liferaydigital_experience_platformMatch7.2fix_pack_3

liferaydigital_experience_platformMatch7.2fix_pack_4

liferaydigital_experience_platformMatch7.2fix_pack_5

liferaydigital_experience_platformMatch7.2fix_pack_6

liferaydigital_experience_platformMatch7.2fix_pack_7

liferaydigital_experience_platformMatch7.2fix_pack_8

liferaydigital_experience_platformMatch7.2fix_pack_9

liferaydigital_experience_platformMatch7.3-

liferaydigital_experience_platformMatch7.3fix_pack_1

liferaydigital_experience_platformMatch7.3fix_pack_2

liferaydigital_experience_platformMatch7.4-

liferayliferay_portalRange7.0.0–7.4.3.5

CPENameOperatorVersion
liferay:digital_experience_platformliferay digital experience platformeq7.0
liferay:digital_experience_platformliferay digital experience platformeq7.1
liferay:digital_experience_platformliferay digital experience platformeq7.2
liferay:digital_experience_platformliferay digital experience platformeq7.3
liferay:digital_experience_platformliferay digital experience platformeq7.4
liferay:liferay_portalliferay liferay portallt7.4.3.5

CPE	Name	Operator	Version
liferay:digital_experience_platform	liferay digital experience platform	eq	7.0
liferay:digital_experience_platform	liferay digital experience platform	eq	7.1
liferay:digital_experience_platform	liferay digital experience platform	eq	7.2
liferay:digital_experience_platform	liferay digital experience platform	eq	7.3
liferay:digital_experience_platform	liferay digital experience platform	eq	7.4
liferay:liferay_portal	liferay liferay portal	lt	7.4.3.5

References

liferay.com

issues.liferay.com/browse/LPE-17438

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132

Social References

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.2%

JSON

Related for CVE-2022-42132

veracode1 nvd1 cvelist1 prion1 osv1