GitHub Advisoryadvisory · Maven

GHSA-4585-28v2-8h46 Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel

MEDIUM Published 2024-02-20 Modified 2025-07-29 Official page ↗
Aliases
CVE-2024-25150
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-201
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.4.3.4-ga4 → fixed in 7.4.3.4-ga4 • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp19 → fixed in 7.2.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.u4 → fixed in 7.3.10.u4

Description

Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

Related

Alias · CVE (1)

  • CVE-2024-25150 Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References