CVE-2024-25150 — Sensitive Info Insertion into Sent Data in Digital Experience Platform

CWE-201 — Sensitive Info Insertion into Sent Data4 documents4 sources

Severity

4.3MEDIUMNVD

EPSS

0.2%

top 61.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Liferay Digital Experience Platform Liferay Portal Liferay DXP +1 more

Timeline

PublishedFeb 20

Description

Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDliferay/liferay_portal< 7.4.3.4

▶CVEListV5liferay/portal7.2.0 — 7.4.2

▶NVDliferay/digital_experience_platform< 7.2+2

▶CVEListV5liferay/dxp7.3.10 — 7.3.10-dxp-3+1

🔴Vulnerability Details

CVEList

CVE-2024-25150: Information disclosure vulnerability in the Control Panel in Liferay Portal 7↗2024-02-20

▶

OSV

Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel↗2024-02-20

▶

GHSA

Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel↗2024-02-20

▶