CVE-2024-25150
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Vulnerabilidad de divulgación de información en el Panel de control en Liferay Portal 7.2.0 a 7.4.2 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior a la actualización 4, 7.2 anterior al fix pack 19 y las versiones anteriores no compatibles permiten a los usuarios autenticados remotamente obtener el nombre completo de un usuario a partir del título de la página enumerando los nombres de pantalla de los usuarios.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-06 CVE Reserved
- 2024-02-20 CVE Published
- 2024-02-21 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-201: Insertion of Sensitive Information Into Sent Data
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Liferay Search vendor "Liferay" | Portal Search vendor "Liferay" for product "Portal" | >= 7.2.0 <= 7.4.2 Search vendor "Liferay" for product "Portal" and version " >= 7.2.0 <= 7.4.2" | en |
Affected
|