CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2024-25150
Medium (4.3) in liferay. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.4.3.4-ga4.
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-201
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4585-28v2-8h46 | Maven | com.liferay.portal:release.portal.bom | >=7.2.0 <7.4.3.4-ga4 | 7.4.3.4-ga4 |
| GHSA-4585-28v2-8h46 | Maven | com.liferay.portal:release.dxp.bom | <7.2.10.fp19 | 7.2.10.fp19 |
| GHSA-4585-28v2-8h46 | Maven | com.liferay.portal:release.dxp.bom | >=7.3.0 <7.3.10.u4 | 7.3.10.u4 |