CVE-2024-25146: Medium severity Liferay DXP vulnerability

Q: What versions are affected by CVE-2024-25146?

CVE-2024-25146 affects Liferay Portal versions 7.2.0 through 7.4.1, and Liferay DXP 7.3 before service pack 3, along with older unsupported versions.

Q: What is the severity of CVE-2024-25146?

The severity of CVE-2024-25146 has been classified as a moderate risk vulnerability.

Q: How do I fix CVE-2024-25146?

To fix CVE-2024-25146, upgrade to Liferay Portal 7.4.2, Liferay DXP 7.3.10.u4, or Liferay DXP 7.2.10.fp18.

Q: What type of vulnerability is CVE-2024-25146?

CVE-2024-25146 is a response manipulation vulnerability that alters the responses based on site access permissions.

Q: Can I continue using my current version with CVE-2024-25146?

It is not recommended to continue using affected versions of Liferay due to the security risks posed by CVE-2024-25146.

Published Feb 8, 2024

Updated

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

Affected Software

43 affected componentsFixes available

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp18

7.2.10.fp18

maven/com.liferay.portal:release.dxp.bom>=7.3.0<7.3.10.u4

7.3.10.u4

maven/com.liferay.portal:release.portal.bom>=7.2.0<7.4.2

7.4.2

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_10

Liferay DXP=7.2-fix_pack_11

Liferay DXP=7.2-fix_pack_12

Liferay DXP=7.2-fix_pack_13

Liferay DXP=7.2-fix_pack_14

Liferay DXP=7.2-fix_pack_15

Liferay DXP=7.2-fix_pack_16

Liferay DXP=7.2-fix_pack_17

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay DXP=7.2-fix_pack_9

Liferay DXP=7.3

Liferay DXP=7.3-sp1

Liferay DXP=7.3-sp2

Liferay Liferay Portal>=7.2.0<=7.4.1

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_10

Liferay Digital Experience Platform=7.2-fix_pack_11

Liferay Digital Experience Platform=7.2-fix_pack_12

Liferay Digital Experience Platform=7.2-fix_pack_13

Liferay Digital Experience Platform=7.2-fix_pack_14

Liferay Digital Experience Platform=7.2-fix_pack_15

Liferay Digital Experience Platform=7.2-fix_pack_16

Liferay Digital Experience Platform=7.2-fix_pack_17

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

Liferay Digital Experience Platform=7.2-fix_pack_9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.2.10.fp18
Upgrade
Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.
Fixed in 7.3.10.u4
Upgrade
Upgrade maven/com.liferay.portal:release.portal.bom to a version that resolves this vulnerability.
Fixed in 7.4.2
Configuration
Change locale.prepend.friendly.url.style from 2 to a value other than 2 to avoid the vulnerability condition (it occurs if locale.prepend.friendly.url.style=2 and a custom 404 page is used).
Liferay Portal / Liferay DXP locale.prepend.friendly.url.style = 2

Event History

Feb 8, 2024

CVE Published

via MITRE·03:36 AM

Data Sourced

via MITRE·03:36 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·06:30 AM

Frequently Asked Questions

What versions are affected by CVE-2024-25146?

CVE-2024-25146 affects Liferay Portal versions 7.2.0 through 7.4.1, and Liferay DXP 7.3 before service pack 3, along with older unsupported versions.

What is the severity of CVE-2024-25146?