Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP Username Enumeration Vulnerability

Vulnerability

A username enumeration vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, as well as in several Liferay DXP 2024 and 2023 versions. This vulnerability allows attackers to verify the existence of user accounts by analyzing the server response times during the login process.

Impact

Exploitation of this vulnerability allows for username enumeration, enabling attackers to determine valid user accounts within the application.

Remediation

Users can upgrade to Liferay DXP 2024.Q1.15, Liferay DXP 2025.Q1.0, or Liferay DXP 2025.Q2.0 to address this vulnerability.

Added: Aug 21, 2025, 6:21 PM
Updated: Aug 21, 2025, 6:21 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.6
exploitability
7.4
remediation
7.7
relevance
0.4
threat
0.0
urgency
2.9
incentive
5.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.