GitHub Advisoryadvisory · Maven

GHSA-2mvj-q2q3-wxjv Liferay Portal and Liferay DXP HTTP Header Can Expose Versions

MEDIUM Published 2024-02-20 Modified 2025-07-29 Official page ↗
Aliases
CVE-2024-26267
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1188
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.4.3.26-ga26 → fixed in 7.4.3.26-ga26 • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp19 → fixed in 7.2.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.u5 → fixed in 7.3.10.u5 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u26 → fixed in 7.4.13.u26

Description

In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.

Related

Alias · CVE (1)

  • CVE-2024-26267 In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References