The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_experience_platform | Liferay | 7.0 (including) | 7.0 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_1 (including) | 7.0-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_10 (including) | 7.0-fix_pack_10 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_100 (including) | 7.0-fix_pack_100 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_11 (including) | 7.0-fix_pack_11 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_12 (including) | 7.0-fix_pack_12 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_13 (including) | 7.0-fix_pack_13 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_14 (including) | 7.0-fix_pack_14 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_15 (including) | 7.0-fix_pack_15 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_16 (including) | 7.0-fix_pack_16 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_17 (including) | 7.0-fix_pack_17 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_18 (including) | 7.0-fix_pack_18 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_19 (including) | 7.0-fix_pack_19 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_2 (including) | 7.0-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_20 (including) | 7.0-fix_pack_20 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_21 (including) | 7.0-fix_pack_21 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_22 (including) | 7.0-fix_pack_22 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_23 (including) | 7.0-fix_pack_23 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_24 (including) | 7.0-fix_pack_24 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_25 (including) | 7.0-fix_pack_25 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_26 (including) | 7.0-fix_pack_26 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_27 (including) | 7.0-fix_pack_27 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_28 (including) | 7.0-fix_pack_28 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_29 (including) | 7.0-fix_pack_29 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_3 (including) | 7.0-fix_pack_3 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_30 (including) | 7.0-fix_pack_30 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_31 (including) | 7.0-fix_pack_31 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_32 (including) | 7.0-fix_pack_32 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_33 (including) | 7.0-fix_pack_33 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_34 (including) | 7.0-fix_pack_34 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_35 (including) | 7.0-fix_pack_35 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_36 (including) | 7.0-fix_pack_36 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_37 (including) | 7.0-fix_pack_37 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_38 (including) | 7.0-fix_pack_38 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_39 (including) | 7.0-fix_pack_39 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_4 (including) | 7.0-fix_pack_4 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_40 (including) | 7.0-fix_pack_40 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_41 (including) | 7.0-fix_pack_41 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_42 (including) | 7.0-fix_pack_42 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_43 (including) | 7.0-fix_pack_43 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_44 (including) | 7.0-fix_pack_44 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_45 (including) | 7.0-fix_pack_45 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_46 (including) | 7.0-fix_pack_46 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_47 (including) | 7.0-fix_pack_47 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_48 (including) | 7.0-fix_pack_48 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_49 (including) | 7.0-fix_pack_49 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_5 (including) | 7.0-fix_pack_5 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_50 (including) | 7.0-fix_pack_50 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_51 (including) | 7.0-fix_pack_51 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_52 (including) | 7.0-fix_pack_52 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_53 (including) | 7.0-fix_pack_53 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_54 (including) | 7.0-fix_pack_54 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_55 (including) | 7.0-fix_pack_55 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_56 (including) | 7.0-fix_pack_56 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_57 (including) | 7.0-fix_pack_57 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_58 (including) | 7.0-fix_pack_58 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_59 (including) | 7.0-fix_pack_59 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_6 (including) | 7.0-fix_pack_6 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_60 (including) | 7.0-fix_pack_60 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_61 (including) | 7.0-fix_pack_61 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_62 (including) | 7.0-fix_pack_62 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_63 (including) | 7.0-fix_pack_63 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_64 (including) | 7.0-fix_pack_64 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_65 (including) | 7.0-fix_pack_65 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_66 (including) | 7.0-fix_pack_66 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_67 (including) | 7.0-fix_pack_67 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_68 (including) | 7.0-fix_pack_68 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_69 (including) | 7.0-fix_pack_69 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_7 (including) | 7.0-fix_pack_7 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_70 (including) | 7.0-fix_pack_70 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_71 (including) | 7.0-fix_pack_71 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_72 (including) | 7.0-fix_pack_72 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_73 (including) | 7.0-fix_pack_73 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_74 (including) | 7.0-fix_pack_74 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_75 (including) | 7.0-fix_pack_75 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_76 (including) | 7.0-fix_pack_76 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_77 (including) | 7.0-fix_pack_77 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_78 (including) | 7.0-fix_pack_78 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_79 (including) | 7.0-fix_pack_79 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_8 (including) | 7.0-fix_pack_8 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_80 (including) | 7.0-fix_pack_80 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_81 (including) | 7.0-fix_pack_81 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_82 (including) | 7.0-fix_pack_82 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_83 (including) | 7.0-fix_pack_83 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_84 (including) | 7.0-fix_pack_84 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_85 (including) | 7.0-fix_pack_85 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_86 (including) | 7.0-fix_pack_86 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_87 (including) | 7.0-fix_pack_87 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_88 (including) | 7.0-fix_pack_88 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_89 (including) | 7.0-fix_pack_89 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_9 (including) | 7.0-fix_pack_9 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_90 (including) | 7.0-fix_pack_90 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_91 (including) | 7.0-fix_pack_91 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_92 (including) | 7.0-fix_pack_92 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_93 (including) | 7.0-fix_pack_93 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_94 (including) | 7.0-fix_pack_94 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_95 (including) | 7.0-fix_pack_95 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_96 (including) | 7.0-fix_pack_96 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_97 (including) | 7.0-fix_pack_97 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_98 (including) | 7.0-fix_pack_98 (including) |
| Digital_experience_platform | Liferay | 7.0-fix_pack_99 (including) | 7.0-fix_pack_99 (including) |
| Digital_experience_platform | Liferay | 7.1 (including) | 7.1 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_1 (including) | 7.1-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_10 (including) | 7.1-fix_pack_10 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_11 (including) | 7.1-fix_pack_11 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_12 (including) | 7.1-fix_pack_12 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_13 (including) | 7.1-fix_pack_13 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_14 (including) | 7.1-fix_pack_14 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_15 (including) | 7.1-fix_pack_15 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_16 (including) | 7.1-fix_pack_16 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_17 (including) | 7.1-fix_pack_17 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_18 (including) | 7.1-fix_pack_18 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_19 (including) | 7.1-fix_pack_19 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_2 (including) | 7.1-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_20 (including) | 7.1-fix_pack_20 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_21 (including) | 7.1-fix_pack_21 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_22 (including) | 7.1-fix_pack_22 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_23 (including) | 7.1-fix_pack_23 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_24 (including) | 7.1-fix_pack_24 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_25 (including) | 7.1-fix_pack_25 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_26 (including) | 7.1-fix_pack_26 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_3 (including) | 7.1-fix_pack_3 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_4 (including) | 7.1-fix_pack_4 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_5 (including) | 7.1-fix_pack_5 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_6 (including) | 7.1-fix_pack_6 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_7 (including) | 7.1-fix_pack_7 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_8 (including) | 7.1-fix_pack_8 (including) |
| Digital_experience_platform | Liferay | 7.1-fix_pack_9 (including) | 7.1-fix_pack_9 (including) |
| Digital_experience_platform | Liferay | 7.1-sp1 (including) | 7.1-sp1 (including) |
| Digital_experience_platform | Liferay | 7.2 (including) | 7.2 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_1 (including) | 7.2-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_10 (including) | 7.2-fix_pack_10 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_11 (including) | 7.2-fix_pack_11 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_12 (including) | 7.2-fix_pack_12 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_13 (including) | 7.2-fix_pack_13 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_14 (including) | 7.2-fix_pack_14 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_15 (including) | 7.2-fix_pack_15 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_16 (including) | 7.2-fix_pack_16 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_2 (including) | 7.2-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_3 (including) | 7.2-fix_pack_3 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_4 (including) | 7.2-fix_pack_4 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_5 (including) | 7.2-fix_pack_5 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_6 (including) | 7.2-fix_pack_6 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_7 (including) | 7.2-fix_pack_7 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_8 (including) | 7.2-fix_pack_8 (including) |
| Digital_experience_platform | Liferay | 7.2-fix_pack_9 (including) | 7.2-fix_pack_9 (including) |
| Digital_experience_platform | Liferay | 7.3 (including) | 7.3 (including) |
| Digital_experience_platform | Liferay | 7.3-fix_pack_1 (including) | 7.3-fix_pack_1 (including) |
| Digital_experience_platform | Liferay | 7.3-fix_pack_2 (including) | 7.3-fix_pack_2 (including) |
| Digital_experience_platform | Liferay | 7.4 (including) | 7.4 (including) |
| Liferay_portal | Liferay | 7.0.0 (including) | 7.4.3.5 (excluding) |
There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include:
Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include:
Information exposures can occur in different ways:
It is common practice to describe any loss of confidentiality as an “information exposure,” but this can lead to overuse of CWE-200 in CWE mapping. From the CWE perspective, loss of confidentiality is a technical impact that can arise from dozens of different weaknesses, such as insecure file permissions or out-of-bounds read. CWE-200 and its lower-level descendants are intended to cover the mistakes that occur in behaviors that explicitly manage, store, transfer, or cleanse sensitive information.