LDAP Credential Exposure in Liferay Portal and Liferay DXP

CVE-2022-42132

What is CVE-2022-42132?

The Liferay Portal and Liferay DXP products have a vulnerability where the Test LDAP Users functionality exposes LDAP credentials in the URL during user pagination. This could allow a man-in-the-middle attacker or someone with access to the request logs to capture sensitive information. It is crucial for users of affected versions to review their configurations and apply necessary updates to mitigate the risk of credential exposure.

References