GitHub Advisoryadvisory · Maven

GHSA-qm43-g2xj-hvg5 Liferay Portal and Liferay DXP User Enumeration Vulnerability

MEDIUM Published 2024-02-20 Modified 2025-07-29 Official page ↗
Aliases
CVE-2024-26268
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.4.3.27-ga27 → fixed in 7.4.3.27-ga27 • Maven com.liferay.portal:release.dxp.bom: < 7.2.10.fp20 → fixed in 7.2.10.fp20 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.u8 → fixed in 7.3.10.u8 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, < 7.4.13.u27 → fixed in 7.4.13.u27

Description

User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

Related

Alias · CVE (1)

  • CVE-2024-26268 User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References