CVE-2024-25146

State: Published
Severity: 5.3 Medium
Published: Feb 8, 2024
Updated: May 15, 2025
Reserved: Feb 6, 2024

Description

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Liferay

Weaknesses

CWE-204 Observable Response Discrepancy

Affected Products

Product	Versions
PortalLiferay	7.2.0 through 7.4.1Affected
DXPLiferay	7.3.10 through 7.3.10-dxp-2Affected 7.2.10 through 7.2.10-dxp-17Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.