CVE-2024-25150

Summary

Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

Affected Software

VendorProductVersion RangeStatus
LiferayPortal7.2.0 <= 7.4.2affected
LiferayDXP7.3.10 <= 7.3.10-dxp-3affected
LiferayDXP7.2.10 <= 7.2.10-dxp-18affected

Weaknesses

  • CWE-201: CWE-201 Insertion of Sensitive Information Into Sent Data

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References