CVE-2024-25150

EPSS 0.44%
Veröffentlicht 20.02.2024 08:15:07
Zuletzt bearbeitet 10.12.2024 23:01:58
Erkennungen
Login

Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 32 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version < 7.2

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_17

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_18

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_5

Liferay ≫ Digital Experience Platform Version 7.2 Update service_pack_6

Liferay ≫ Digital Experience Platform Version 7.3 Update -

Liferay ≫ Digital Experience Platform Version 7.3 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.3 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.3 Update service_pack_1

Liferay ≫ Digital Experience Platform Version 7.3 Update service_pack_3

Liferay ≫ Liferay Portal Version < 7.4.3.4

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.44%	0.349

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
security@liferay.com	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-201 Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-25150

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-25150

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-25150

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2024-25150