GitHub Advisoryadvisory · Maven

GHSA-mf8h-grfg-j9j3 Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API

MEDIUM Published 2024-02-20 Modified 2025-07-29 Official page ↗
Aliases
CVE-2024-25605
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.4.3.5-ga5 → fixed in 7.4.3.5-ga5 • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp17 → fixed in 7.2.10.fp17

Description

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

Related

Alias · CVE (1)

  • CVE-2024-25605 The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References