Volerion logoVolerion
Volerion logoVolerion

Liferay Portal and Liferay DXP Password Enumeration Vulnerability

Vulnerability

A password enumeration vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.119, older unsupported versions, and in Liferay DXP versions 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. This vulnerability allows remote attackers to determine a user's password through brute force attacks, even if account lockout mechanisms are enabled.

Impact

Exploitation of this vulnerability allows for successful password enumeration, enabling attackers to determine valid passwords for user accounts.

Remediation

Users can upgrade to Liferay Portal 7.4.3.120 or Liferay DXP versions 2024.Q4.0, 2024.Q3.0, 2024.Q2.0, or 2024.Q1.6 to address this vulnerability.

Added: Oct 30, 2025, 12:17 AM
Updated: Oct 30, 2025, 12:17 AM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
2.5
exploitability
6.2
remediation
7.7
relevance
0.8
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.