medium4.3
CVE-2024-25150
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
Impact
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >= 7.2.0, < 7.4.3.4-ga4 | 7.4.3.4-ga4 |
| maven | com.liferay.portal:release.dxp.bom | < 7.2.10.fp19 | 7.2.10.fp19 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Digital Experience Platform | before 7.2 Versions 7.2, 7.3 |
| Liferay | Liferay Portal | before 7.4.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150
- https://github.com/advisories/GHSA-4585-28v2-8h46
- https://nvd.nist.gov/vuln/detail/CVE-2024-25150
- https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86
- https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc
- https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04
- https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc
- https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d
- https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0