CVE-2024-25148: 
Java vulnerability analysis and mitigation

CVE-2024-25148 is a security vulnerability discovered in Liferay Portal and Liferay DXP, disclosed on February 7, 2024. The vulnerability involves the potential leakage of the doAsUserId URL parameter when creating linked content using the WYSIWYG editor while impersonating a user. The affected versions include Liferay Portal 7.2.0 through 7.4.1 and older unsupported versions, as well as Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions (Liferay Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by Liferay Inc. with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, while the NVD assessment indicates a higher severity score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) (NVD Database).

The vulnerability could allow remote authenticated users to impersonate other users after accessing linked content where the doAsUserId parameter has been leaked. This poses a significant security risk as it could lead to unauthorized access and potential privilege escalation within the affected Liferay installations (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal 7.4.2, Liferay DXP 7.3 service pack 3, or Liferay DXP 7.2 fix pack 15, depending on their current version (Liferay Advisory).