Liferay Portal and Liferay DXP Password Reminder Answer Exposure Vulnerability

A vulnerability exists in Liferay Portal versions 7.4.0 to 7.4.3.112, older unsupported versions, and Liferay DXP versions 2023.Q4.0 to 2023.Q4.8, 2023.Q3.1 to 2023.Q3.10, and 7.4 GA through update 92. The issue arises because audit event records include a user's password reminder answer. This flaw enables remote authenticated users to retrieve another user's password reminder answer through the audit events.

Impact

Exploitation of this vulnerability allows remote authenticated users to access other users' password reminder answers, potentially leading to unauthorized account access.

Remediation

Users can upgrade to Liferay Portal 7.4.3.113, Liferay DXP 2024.Q2.0, Liferay DXP 2024.Q1.1, or Liferay DXP 2023.Q4.9 to address this vulnerability.