CVE-2022-42132
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
CVE-2022-42132- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
CVE-2022-42132- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-45209
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
EUVD-2022-45209- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f43m-hhj4-q3jg
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
GHSA-f43m-hhj4-q3jg- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSV
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
CVE-2022-42132- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-f43m-hhj4-q3jg
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
GHSA-f43m-hhj4-q3jg- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-522
- Updated
- 2026-11-02
OSVBIT-liferay-2022-42132 No score
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
- Record
BIT-liferay-2022-42132- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.0.0 up to 7.4.3.5-ga5 | 7.4.3.5-ga5 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 to 7.0.10.fp102 | None known |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp27 | 7.1.10.fp27 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp17 | 7.2.10.fp17 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u4 | 7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven |
7.4.0.ga1 to 7.4.0.ga1 | None known |
com.liferay:com.liferay.portal.settings.authentication.ldap.webMaven |
before 5.0.13 | 5.0.13 |
liferayBitnami |
7.0.0 to 7.0.0, 7.1.0 to 7.1.0, 7.2.0 to 7.2.0, 7.3.0 to 7.3.0, 7.4.0 to 7.4.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-sp1.0 to 7.1-sp1.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.3-fix.0 to 7.3-fix.0, 7.3-fix.0 to 7.3-fix.0 | None known |
com.liferay.portal:release.portal.bomMaven |
7.0.0 up to 7.4.3.5-ga5, plus listed versions 7.0.67.0.6-17.0.6-27.1.07.1.1 Show 25 moreShow less7.1.27.1.37.1.3-17.2.07.2.17.2.1-17.3.07.3.0-17.3.17.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.47.4.3.5 |
7.4.3.5-ga5 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 to 7.0.10.fp102, plus listed versions 7.0.10.fp1007.0.10.fp1017.0.10.fp607.0.10.fp617.0.10.fp62 Show 40 moreShow less7.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-17.0.10.fp95-27.0.10.fp977.0.10.fp98 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp27, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 20 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp177.1.10.fp187.1.10.fp197.1.10.fp27.1.10.fp207.1.10.fp227.1.10.fp247.1.10.fp257.1.10.fp267.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
7.1.10.fp27 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp17, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 14 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp137.2.10.fp147.2.10.fp157.2.10.fp167.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp17 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.u4, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp17.3.10.fp2 |
7.3.10.u4 |
com.liferay.portal:release.dxp.bomMaven |
Listed versions 7.4.0.ga1 |
None known |
com.liferay:com.liferay.portal.settings.authentication.ldap.webMaven |
before 5.0.13, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.61.0.71.0.81.0.9 |
5.0.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42132 is a medium vulnerability (CVSS 5.9) in Liferay Portal, published November 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.5-ga5.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132
issues.liferay.com/browse/LPE-17438
nvd.nist.gov/vuln/detail/CVE-2022-42132
liferay.com
github.com/liferay/liferay-portal/commit/4a53b64fb714c7ff989b99ddccc3de116095453d
Show 4 moreShow less
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-42132?p_r_p_assetEntryId=121613918&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121613918%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
web.archive.org/web/20221020134303/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42132
Left out here: 137 versions. The JSON record has them.