GitHub Advisoryadvisory · Maven

GHSA-9427-7f65-88c8 Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled

MEDIUM Published 2022-10-07 Modified 2025-07-16 Official page ↗
Aliases
CVE-2022-41414
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2025-07-16

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.0.0-a1, < 7.4.2-ga3 → fixed in 7.4.2-ga3 • Maven com.liferay.portal:com.liferay.portal.impl: < 8.0.0 → fixed in 8.0.0

Description

An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.

Related

Alias · CVE (1)

  • CVE-2022-41414 An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References