CVE-2024-25605
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.
El módulo Journal en Liferay Portal 7.2.0 a 7.4.3.4 y versiones anteriores no compatibles, y Liferay DXP 7.4.13, 7.3 anteriores al service pack 3, 7.2 anteriores al fix pack 17 y versiones anteriores no compatibles otorga a los usuarios invitados permiso de visualización del contenido web plantillas de forma predeterminada, lo que permite a atacantes remotos ver cualquier plantilla a través de la interfaz de usuario o API.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-02-08 CVE Reserved
- 2024-02-20 CVE Published
- 2024-02-21 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-276: Incorrect Default Permissions
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Liferay Search vendor "Liferay" | Portal Search vendor "Liferay" for product "Portal" | >= 7.2.0.0 <= 7.4.3.4 Search vendor "Liferay" for product "Portal" and version " >= 7.2.0.0 <= 7.4.3.4" | en |
Affected
| ||||||
Liferay Search vendor "Liferay" | DXP Search vendor "Liferay" for product "DXP" | 7.4.13 Search vendor "Liferay" for product "DXP" and version "7.4.13" | en |
Affected
|