VULNERABILITY INTELLIGENCE

CVE-2024-25605

CVSS score5.3 MEDIUM
EPSS probability0.48%
CISA KEVNot currently listed
Published2024-02-20
Last modified2026-06-17

Description

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attackers to view any template via the UI or API.

Primary references