CVE-2024-25146 - Vulnerability Details

Vendors	Products
Liferay	Digital Experience Platform Dxp Liferay Portal

Link	Providers
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Liferay digital Experience Platform
CPEs	cpe:2.3:a:liferay:dxp:7.2:-:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_10:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_11:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_12:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_13:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_14:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_15:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_16:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_17:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:::::: cpe:2.3:a:liferay:dxp:7.2:fix_pack_9::::::	cpe:2.3:a:liferay:digital_experience_platform:7.2:-:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:::::: cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9::::::
Vendors & Products		Liferay digital Experience Platform

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25146", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2024-02-06T10:32:42.567Z", "datePublished": "2024-02-08T03:36:07.512Z", "dateUpdated": "2025-05-15T19:40:55.792Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.2.0", "versionType": "maven"}]}, {"defaultStatus": "unknown", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.3.10-dxp-2", "status": "affected", "version": "7.3.10", "versionType": "maven"}, {"lessThanOrEqual": "7.2.10-dxp-17", "status": "affected", "version": "7.2.10", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."}], "value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "description": "CWE-204 Observable Response Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-08T03:36:07.512Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.804Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-08T15:42:08.641949Z", "id": "CVE-2024-25146", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-15T19:40:55.792Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-25146 (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

state : PUBLISHED (string)

assignerShortName : Liferay (string)

dateReserved : 2024-02-06T10:32:42.567Z (string)

datePublished : 2024-02-08T03:36:07.512Z (string)

dateUpdated : 2025-05-15T19:40:55.792Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unknown (string)

product : Portal (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.4.1 (string)

status : affected (string)

version : 7.2.0 (string)

versionType : maven (string)

}

]

}

1 : { »

defaultStatus : unknown (string)

product : DXP (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.3.10-dxp-2 (string)

status : affected (string)

version : 7.3.10 (string)

versionType : maven (string)

}

1 : { »

lessThanOrEqual : 7.2.10-dxp-17 (string)

status : affected (string)

version : 7.2.10 (string)

versionType : maven (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. (string)

}

]

value : Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-204 (string)

description : CWE-204 Observable Response Discrepancy (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2024-02-08T03:36:07.512Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T23:36:21.804Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-05-08T15:42:08.641949Z (string)

id : CVE-2024-25146 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-05-15T19:40:55.792Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.804Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-25146", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-08T15:42:08.641949Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-08T15:42:10.305Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "maven", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unknown"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "7.3.10", "versionType": "maven", "lessThanOrEqual": "7.3.10-dxp-2"}, {"status": "affected", "version": "7.2.10", "versionType": "maven", "lessThanOrEqual": "7.2.10-dxp-17"}], "defaultStatus": "unknown"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.", "supportingMedia": [{"type": "text/html", "value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204 Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-08T03:36:07.512Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25146", "state": "PUBLISHED", "dateUpdated": "2025-05-15T19:40:55.792Z", "dateReserved": "2024-02-06T10:32:42.567Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2024-02-08T03:36:07.512Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T23:36:21.804Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-25146 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-05-08T15:42:08.641949Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-05-08T15:42:10.305Z (string)

}

]

cna : { »

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Liferay (string)

product : Portal (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.2.0 (string)

versionType : maven (string)

lessThanOrEqual : 7.4.1 (string)

}

]

defaultStatus : unknown (string)

}

1 : { »

vendor : Liferay (string)

product : DXP (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.3.10 (string)

versionType : maven (string)

lessThanOrEqual : 7.3.10-dxp-2 (string)

}

1 : { »

status : affected (string)

version : 7.2.10 (string)

versionType : maven (string)

lessThanOrEqual : 7.2.10-dxp-17 (string)

}

]

defaultStatus : unknown (string)

}

]

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-204 (string)

description : CWE-204 Observable Response Discrepancy (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2024-02-08T03:36:07.512Z (string)

}

cveMetadata : { »

cveId : CVE-2024-25146 (string)

state : PUBLISHED (string)

dateUpdated : 2025-05-15T19:40:55.792Z (string)

dateReserved : 2024-02-06T10:32:42.567Z (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

datePublished : 2024-02-08T03:36:07.512Z (string)

assignerShortName : Liferay (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*", "matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*", "matchCriteriaId": "E7E68DF8-749B-4284-A7C9-929701A86B36", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*", "matchCriteriaId": "340DF1FE-5720-4516-BA51-F2197A654409", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*", "matchCriteriaId": "97E155DE-05C6-4559-94A8-0EFEB958D0C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*", "matchCriteriaId": "0635FB5F-9C90-49C7-A9EF-00C0396FCCAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*", "matchCriteriaId": "77523B76-FC26-41B1-A804-7372E13F4FB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*", "matchCriteriaId": "B15397B8-5087-4239-AE78-D3C37D59DE83", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*", "matchCriteriaId": "311EE92A-0EEF-4556-A52F-E6C9522FA2DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*", "matchCriteriaId": "49501C9E-D12A-45E0-92F3-8FD5FDC6D3CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:*:*:*:*:*:*", "matchCriteriaId": "F2B55C77-9FAA-4E14-8CEF-9C4CAC804007", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*", "matchCriteriaId": "7CECAA19-8B7F-44C8-8059-6D4F2105E196", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*", "matchCriteriaId": "68CBCEEB-7C28-4769-813F-3F01E33D2E08", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*", "matchCriteriaId": "C0CB4927-A361-4DFA-BDB8-A454EA2894AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*", "matchCriteriaId": "B2B771B7-D5CB-4778-A3A8-1005E4EE134C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*", "matchCriteriaId": "3B9DB383-3791-4A43-BA4D-7695B203E736", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*", "matchCriteriaId": "13F02D77-20E9-4F32-9752-511EB71E6704", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*", "matchCriteriaId": "6353CC8F-A6D4-4A0C-8D68-290CD8DEB4F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*", "matchCriteriaId": "759DDB90-6A89-4E4F-BD04-F70EFA5343B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:*", "matchCriteriaId": "21C55D41-DB66-494D-BEEB-BDAC7CB4B31B", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:*", "matchCriteriaId": "9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:*", "matchCriteriaId": "D86CDCC0-9655-477B-83FA-ADDBB5AF43A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "F247D45A-D3E4-4EDD-A18D-147FFBEF0935", "versionEndIncluding": "7.4.1", "versionStartIncluding": "7.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used."}, {"lang": "es", "value": "Liferay Portal 7.2.0 a 7.4.1 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior al service pack 3, 7.2 anterior al fix pack 18 y versiones anteriores no compatibles devuelven respuestas diferentes dependiendo de si un sitio no existe o si el usuario no tiene permiso para acceder al sitio, lo que permite a atacantes remotos descubrir la existencia de sitios enumerando las URL. Esta vulnerabilidad ocurre si locale.prepend.friendly.url.style=2 y si se utiliza una p\u00e1gina 404 personalizada."}], "id": "CVE-2024-25146", "lastModified": "2025-05-13T18:17:51.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@liferay.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-08T04:15:08.040", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "security@liferay.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* (string)

matchCriteriaId : 0DCF7F39-A198-4F7E-84B7-90C88C1BAA96 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* (string)

matchCriteriaId : E7E68DF8-749B-4284-A7C9-929701A86B36 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:* (string)

matchCriteriaId : 340DF1FE-5720-4516-BA51-F2197A654409 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:* (string)

matchCriteriaId : 97E155DE-05C6-4559-94A8-0EFEB958D0C9 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:* (string)

matchCriteriaId : 0635FB5F-9C90-49C7-A9EF-00C0396FCCAE (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:* (string)

matchCriteriaId : 77523B76-FC26-41B1-A804-7372E13F4FB2 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:* (string)

matchCriteriaId : B15397B8-5087-4239-AE78-D3C37D59DE83 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:* (string)

matchCriteriaId : 311EE92A-0EEF-4556-A52F-E6C9522FA2DD (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:* (string)

matchCriteriaId : 49501C9E-D12A-45E0-92F3-8FD5FDC6D3CF (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:*:*:*:*:*:* (string)

matchCriteriaId : F2B55C77-9FAA-4E14-8CEF-9C4CAC804007 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* (string)

matchCriteriaId : 7CECAA19-8B7F-44C8-8059-6D4F2105E196 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* (string)

matchCriteriaId : 68CBCEEB-7C28-4769-813F-3F01E33D2E08 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* (string)

matchCriteriaId : C0CB4927-A361-4DFA-BDB8-A454EA2894AB (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* (string)

matchCriteriaId : B2B771B7-D5CB-4778-A3A8-1005E4EE134C (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* (string)

matchCriteriaId : 3B9DB383-3791-4A43-BA4D-7695B203E736 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* (string)

matchCriteriaId : 13F02D77-20E9-4F32-9752-511EB71E6704 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:* (string)

matchCriteriaId : 6353CC8F-A6D4-4A0C-8D68-290CD8DEB4F8 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:* (string)

matchCriteriaId : 759DDB90-6A89-4E4F-BD04-F70EFA5343B0 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:liferay:dxp:7.3:-:*:*:*:*:*:* (string)

matchCriteriaId : 21C55D41-DB66-494D-BEEB-BDAC7CB4B31B (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:liferay:dxp:7.3:sp1:*:*:*:*:*:* (string)

matchCriteriaId : 9D75A0FF-BAEA-471A-87B2-8EC2A9F0A6B5 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:liferay:dxp:7.3:sp2:*:*:*:*:*:* (string)

matchCriteriaId : D86CDCC0-9655-477B-83FA-ADDBB5AF43A2 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F247D45A-D3E4-4EDD-A18D-147FFBEF0935 (string)

versionEndIncluding : 7.4.1 (string)

versionStartIncluding : 7.2.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used. (string)

}

1 : { »

lang : es (string)

value : Liferay Portal 7.2.0 a 7.4.1 y versiones anteriores no compatibles, y Liferay DXP 7.3 anterior al service pack 3, 7.2 anterior al fix pack 18 y versiones anteriores no compatibles devuelven respuestas diferentes dependiendo de si un sitio no existe o si el usuario no tiene permiso para acceder al sitio, lo que permite a atacantes remotos descubrir la existencia de sitios enumerando las URL. Esta vulnerabilidad ocurre si locale.prepend.friendly.url.style=2 y si se utiliza una página 404 personalizada. (string)

}

]

id : CVE-2024-25146 (string)

lastModified : 2025-05-13T18:17:51.450 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 1.4 (number)

source : security@liferay.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-02-08T04:15:08.040 (string)

references : [ »

0 : { »

source : security@liferay.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25146 (string)

}

]

sourceIdentifier : security@liferay.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-204 (string)

}

]

source : security@liferay.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-203 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object