PT-2024-20784 · Liferay · Liferay Portal+1

Sahil Mehra · Published 2024-02-20 · Updated 2024-12-10 · CVE-2024-25150

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.2 Liferay DXP 7.3 before update 4 Liferay DXP 7.2 before fix pack 19

Description The issue allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names. This is an information disclosure vulnerability in the Control Panel.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.2, update to a version outside of this range to resolve the issue. For Liferay DXP 7.3, apply update 4 or later. For Liferay DXP 7.2, apply fix pack 19 or later. As a temporary workaround, consider restricting access to the Control Panel to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2024-25150

GHSA-4585-28V2-8H46

Affected Products

Liferay Dxp

Liferay Portal

References · 14

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25150 · Security Note
• https://osv.dev/vulnerability/GHSA-4585-28v2-8h46 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d · Note
• https://github.com/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc · Note
• https://github.com/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0 · Note
• https://github.com/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc · Note
• https://github.com/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04 · Note
• https://github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86 · Note
• https://twitter.com/CVEnew/status/1759859941731410363 · Twitter Post
• https://t.me/cvenotify/71943 · Telegram Post
• https://t.me/cvenotify/103809 · Telegram Post