PT-2022-25851 · Liferay · Liferay Portal

Published 2022-10-07 · Updated 2022-10-11 · CVE-2022-41414

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.4.2

Description The issue is related to an insecure default in the auth.login.prompt.enabled component, which allows attackers to enumerate usernames, site names, and pages.

Recommendations For Liferay Portal versions 7.0.0 through 7.4.2, consider disabling the auth.login.prompt.enabled component to prevent username, site name, and page enumeration until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-41414

GHSA-9427-7F65-88C8

Affected Products

Liferay Portal

References · 8

• https://osv.dev/vulnerability/GHSA-9427-7f65-88c8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41414 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41414 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/659c4422bd32b1db1a01a7f4a42b7702d512ffa2 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-01-insecure-defaults-auth-login-prompt-enabled?p_r_p_assetEntryId=121612026&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612026%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cibsecurity/51008 · Telegram Post
• https://portal.liferay.dev/learn/security/known-vulnerabilities · Note