← CVE Intelligence

CVE-2024-25605

Liferay / Portal PUBLISHED

Description (CNA)

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

Affected (CNA)

Vendor / productVersions
Liferay / Portalaffected 7.2.0 through 7.4.3.4
Liferay / DXPaffected 7.4.13; affected 7.3.10 through 7.3.10-dxp-2; affected 7.2.10 through 7.2.10-dxp-16

CWE

CWE-276

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.