Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP User Enumeration Vulnerability

Vulnerability

A user enumeration vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, as well as in several Liferay DXP releases. This vulnerability allows remote attackers to verify the existence of user accounts by using the create account page.

Impact

Exploitation of this vulnerability allows for user enumeration, enabling attackers to determine which accounts exist within the application.

Remediation

Users of Liferay Portal can upgrade to the latest version available on the master branch. Liferay DXP users should upgrade to version 2024.Q1.15, 2025.Q1.0, or 2025.Q2.0.

Added: Aug 22, 2025, 4:27 PM
Updated: Aug 22, 2025, 6:56 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.6
exploitability
7.4
remediation
7.7
relevance
0.4
threat
0.0
urgency
2.9
incentive
5.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.