CVE-2024-25150 json
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
published 2y ago modified 4mo ago also GHSA-4585-28v2-8h46 , EUVD-2024-22490
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Patch / fix
- maven com.liferay.portal:release.portal.bom 7.4.3.4-ga4
- maven com.liferay.portal:release.dxp.bom 7.2.10.fp19, 7.3.10.u4
- liferay digital_experience_platform 7.2
- liferay liferay_portal 7.4.3.4
Is CVE-2024-25150 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.2.0, <7.4.3.4-ga4 |
7.4.3.4-ga4 |
| maven | com.liferay.portal:release.dxp.bom | <7.2.10.fp19 >=7.3.0, <7.3.10.u4 |
7.2.10.fp19 7.3.10.u4 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-201 Insertion of Sensitive Information Into Sent Data
References
-
github.com
/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86
web
-
github.com
/liferay/liferay-portal/commit/8eba0b84a0967ad785d96cb09f41f3fac998dcfc
web
-
github.com
/liferay/liferay-portal/commit/9d7676866a77c910a7cf689e33c621666bff9a04
web
-
github.com
/liferay/liferay-portal/commit/c5fa9c50514d2be0191cb076b8744c7a871f23dc
web
-
github.com
/liferay/liferay-portal/commit/eee01ec6cce3cca99c9e12fba846db1fc64d610d
web
-
github.com
/liferay/liferay-portal/commit/f9d6c9b9551956c6f07d4ae8998f53392e3389c0
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-25150
advisory
-
github.com
/liferay/liferay-portal
package
Sources
- CVE List CVE-2024-25150
- GitHub Advisory GHSA-4585-28v2-8h46
- NVD CVE-2024-25150
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.