Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Liferay Portal Observable Discrepancy Vulnerability - CVE-2024-25146 - Vulnerability Database
Liferay Portal

Liferay Portal Observable Discrepancy Vulnerability - CVE-2024-25146

Medium
Reference: CVE-2024-25146
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-25146
Title: Liferay Portal Observable Discrepancy Vulnerability
Overview:

Liferay Portal 7.2.0 through 7.4.1 and older unsupported versions and Liferay DXP 7.3 before service pack 3 7.2 before fix pack 18 and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style2 and if a custom 404 page is used.