-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.adaptive.media.web | maven | < 5.0.52 | 5.0.52 |
| com.liferay.portal:com.liferay.portal.impl | maven | < 69.1.0 | 69.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is caused by an incorrect Cache-Control header being set on file downloads, which allows browsers to cache potentially sensitive files. An attacker with local access to a user's computer could then access these files from the browser's cache.
The analysis of the provided patches reveals two key locations where this vulnerability is addressed:
com.liferay.portal.webserver.WebServerServlet.service: This servlet is responsible for serving files from the Document Library. The patch modifies the service method to check if the request is for a download (via the download parameter). If it is, the Cache-Control header is set to no-cache, preventing the browser from caching the file. Otherwise, it defaults to private.
com.liferay.adaptive.media.web.internal.servlet.AMServlet.doGet: This servlet handles files for the Adaptive Media module. The patch applies the same logic to the doGet method, setting the Cache-Control header to no-cache for downloads to prevent caching.
Both of these functions are directly involved in processing file download requests and were responsible for setting the incorrect cache header. Therefore, they are the vulnerable functions that would appear in a runtime profile during the exploitation of this vulnerability.
com.liferay.portal.webserver.WebServerServlet.serviceportal-impl/src/com/liferay/portal/webserver/WebServerServlet.java
com.liferay.adaptive.media.web.internal.servlet.AMServlet.doGetmodules/apps/adaptive-media/adaptive-media-web/src/main/java/com/liferay/adaptive/media/web/internal/servlet/AMServlet.java
JavaJavaOngoing coverage of React2Shell