CVE-2024-25605: Liferay Portal and DXP Grant Unauthorized Access to Web Content Templates
Summary
CVE-2024-25605: Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API. Affects com.liferay.portal:release.portal.bom versions >= 7.2.0, < 7.4.3.5-ga5. Fixed in 7.4.3.5-ga5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform for building web applications and managing content. It provides features such as content management, collaboration, and social networking. The Journal module within Liferay allows users to create and manage web content templates. However, certain versions of Liferay Portal and Liferay DXP have a vulnerability that permits guest users to view web content templates without proper authorization, exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the Journal module in Liferay Portal versions 7.2.0 through 7.4.3.4 and older unsupported versions, as well as Liferay DXP versions 7.4.13, 7.3 before service pack 3, and 7.2 before fix pack 17. By default, guest users are granted view permission to web content templates, allowing remote attackers to access any template via the user interface or API. This could lead to unauthorized information disclosure and potential exploitation of sensitive data.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.5-ga5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict guest user permissions for viewing web content templates. This can be done by modifying the permissions settings in the Liferay Portal administration panel to ensure that only authenticated users can access these templates.
Conclusion
CVE-2024-25605 is a significant vulnerability in Liferay Portal and Liferay DXP that allows unauthorized access to web content templates. It is crucial for users of these platforms to update to the patched versions to mitigate the risk of unauthorized information disclosure. Additionally, implementing temporary workarounds can help secure the application until the update is applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-25605 is a vulnerability in Liferay Portal and Liferay DXP that allows unauthorized access to web content templates by guest users.
The affected versions include Liferay Portal 7.2.0 through 7.4.3.4 and Liferay DXP 7.4.13, 7.3 before service pack 3, and 7.2 before fix pack 17.
The vulnerability can lead to unauthorized information disclosure, allowing attackers to view sensitive web content templates through the UI or API.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
