CVE-2024-25150
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
CVE-2024-25150- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2024-22490
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
EUVD-2024-22490- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4585-28v2-8h46
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
GHSA-4585-28v2-8h46- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
NVD
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
CVE-2024-25150- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
OSV
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
CVE-2024-25150- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-4585-28v2-8h46
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote authenticated users to obtain a user's full name from the page's title by enumerating user screen names.
- Record
GHSA-4585-28v2-8h46- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven | 7.2.0 up to 7.4.3.4-ga4 | 7.4.3.4-ga4 |
com.liferay.portal:release.dxp.bomMaven | before 7.2.10.fp19 | 7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven | 7.3.0 up to 7.3.10.u4 | 7.3.10.u4 |
com.liferay.portal:release.portal.bomMaven | 7.2.0 up to 7.4.3.4-ga4, plus listed versions 7.2.17.2.1-17.3.07.3.0-17.3.1 Show 15 moreShow less7.3.1-17.3.27.3.2-17.3.37.3.3-17.3.47.3.57.3.67.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.4 | 7.4.3.4-ga4 |
com.liferay.portal:release.dxp.bomMaven | before 7.2.10.fp19, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 | 7.2.10.fp19 |
com.liferay.portal:release.dxp.bomMaven | 7.3.0 up to 7.3.10.u4, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp17.3.10.fp2 | 7.3.10.u4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25150 is a medium vulnerability (CVSS 4.3) in Liferay Dxp, published February 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.4-ga4.
References
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25150
nvd.nist.gov/vuln/detail/CVE-2024-25150
github.com/liferay/liferay-portal/commit/12844a327061ad55e560f5ab7056381e9cc05d86
Left out here: 58 versions. The JSON record has them.