Lucene search

K
cve[email protected]CVE-2024-25146
HistoryFeb 08, 2024 - 4:15 a.m.

CVE-2024-25146

2024-02-0804:15:08
CWE-204
CWE-203
web.nvd.nist.gov
19
liferay
portal
security
vulnerability
cve-2024-25146
site enumeration

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

Affected configurations

NVD
Node
liferaydxpMatch7.2-
OR
liferaydxpMatch7.2fix_pack_1
OR
liferaydxpMatch7.2fix_pack_10
OR
liferaydxpMatch7.2fix_pack_11
OR
liferaydxpMatch7.2fix_pack_12
OR
liferaydxpMatch7.2fix_pack_13
OR
liferaydxpMatch7.2fix_pack_14
OR
liferaydxpMatch7.2fix_pack_15
OR
liferaydxpMatch7.2fix_pack_16
OR
liferaydxpMatch7.2fix_pack_17
OR
liferaydxpMatch7.2fix_pack_2
OR
liferaydxpMatch7.2fix_pack_3
OR
liferaydxpMatch7.2fix_pack_4
OR
liferaydxpMatch7.2fix_pack_5
OR
liferaydxpMatch7.2fix_pack_6
OR
liferaydxpMatch7.2fix_pack_7
OR
liferaydxpMatch7.2fix_pack_8
OR
liferaydxpMatch7.2fix_pack_9
OR
liferaydxpMatch7.3-
OR
liferaydxpMatch7.3sp1
OR
liferaydxpMatch7.3sp2
OR
liferayliferay_portalRange7.2.07.4.1

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.1",
        "status": "affected",
        "version": "7.2.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.3.10-dxp-2",
        "status": "affected",
        "version": "7.3.10",
        "versionType": "maven"
      },
      {
        "lessThanOrEqual": "7.2.10-dxp-17",
        "status": "affected",
        "version": "7.2.10",
        "versionType": "maven"
      }
    ]
  }
]

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

Related for CVE-2024-25146