CVE-2024-25605 — Incorrect Default Permissions in Digital Experience Platform

CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 59.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay PortalLiferay DXP+1 more
Timeline
PublishedFeb 20

Description

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDliferay/liferay_portal< 7.4.3.5
▶CVEListV5liferay/portal7.2.0 — 7.4.3.4
▶CVEListV5liferay/dxp7.3.10 — 7.3.10-dxp-2+2

🔴Vulnerability Details

3
CVEList
CVE-2024-25605: The Journal module in Liferay Portal 7↗2024-02-20
▶
OSV
Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API↗2024-02-20
▶
GHSA
Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API↗2024-02-20
▶
CVE-2024-25605 — Incorrect Default Permissions | cvebase