Liferay Portal and Liferay DXP Information Exposure Vulnerability via Log Files

A vulnerability allowing information exposure through log files has been identified in the LDAP import feature of Liferay Portal and Liferay DXP. This issue affects local users who can view user email addresses logged by the application. The vulnerability is present in Liferay Portal versions 7.4.0 to 7.4.3.97, as well as older unsupported versions, and in Liferay DXP versions 2023.Q3.1 to 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions.

Impact

Exploitation of this vulnerability allows local users to access sensitive information, specifically user email addresses, through the application's log files.