Design/Logic Flaw

2024-02-0804:15:00

PRIOn knowledge base

www.prio-n.com

liferay portal 7.2.0

liferay portal 7.4.1

liferay dxp 7.3

logic flaw

remote attack

site enumeration

url

custom 404 page

security vulnerability

7.1 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.0%

JSON

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

CPENameOperatorVersion
dxpeq7.2 fixpack2
dxpeq7.2 fixpack3
dxpeq7.2 fixpack4
dxpeq7.2 fixpack5
dxpeq7.2 fixpack1
dxpeq7.2
dxpeq7.2 fixpack6
dxpeq7.2 fixpack7
dxpeq7.2 fixpack8
dxpeq7.2 fixpack9

Name	Operator	Version
dxp	eq	7.2 fixpack2
dxp	eq	7.2 fixpack3
dxp	eq	7.2 fixpack4
dxp	eq	7.2 fixpack5
dxp	eq	7.2 fixpack1
dxp	eq	7.2
dxp	eq	7.2 fixpack6
dxp	eq	7.2 fixpack7
dxp	eq	7.2 fixpack8
dxp	eq	7.2 fixpack9