Description
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user. This may allow remote authenticated users to impersonate a user after accessing the linked content.
Remediation
References
Related Vulnerabilities
Internet Information Services Other Vulnerability (CVE-1999-0233)
Squid Other Vulnerability (CVE-2024-25617)
Oracle Application Server Other Vulnerability (CVE-2001-0419)
MySQL Out-of-bounds Write Vulnerability (CVE-2009-4484)
Moodle URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-14830)