CVE-2024-25605

Description

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

Risk Information

Base Score

5.3

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

0.186

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2024-25607,CVE-2024-25145,CVE-2021-29038,CVE-2024-25605,CVE-2024-25604 are fixed in Liferay - release.dxp.bom 7.2.10	Windows
Vulnerabilities CVE-2024-25605,CVE-2024-25604 are fixed in Liferay - release.portal.bom 7.4.3.5	Windows
Vulnerabilities CVE-2024-25607,CVE-2024-25145,CVE-2021-29038,CVE-2024-25605,CVE-2024-25604 are fixed in Liferay - release.dxp.bom for Linux 7.2.10	Linux
Vulnerabilities CVE-2024-25605,CVE-2024-25604 are fixed in Liferay - release.portal.bom for Linux 7.4.3.5	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234