GitHub Advisoryadvisory · Maven

GHSA-xwc5-q44v-p6gg Liferay Portal User Enumeration Vulnerability via the Create Account Page

MEDIUM Published 2025-08-22 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43751
Ecosystem
Maven
Packages
com.liferay:com.liferay.login.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-203
Reviewed
2025-08-22

Affected packages

• Maven com.liferay:com.liferay.login.web: < 6.0.66 → fixed in 6.0.66

Description

User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.

Related

Alias · CVE (1)

  • CVE-2025-43751 User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References