IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-09 20:15

MODIFIED

2025-09-11 17:14

EPSS (Prob. Exploit)

0.31%

Top 76.5%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 and 7.4 GA through update 92 allow attackers to determine existent ERC in the application by exploit the time response.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-9p7x-8c57-4pqv MODERATE

Liferay Portal exposes ERC which can lead to exploit the time response attack

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.portal.workflow.api

>= 7.0.1, < 11.0.1

Fixed in: 11.0.1

MAVEN / com.liferay:com.liferay.headless.admin.workflow.impl

>= 5.0.4, < 5.0.83

Fixed in: 5.0.83

MAVEN / com.liferay:com.liferay.portal.vulcan.impl

>= 5.0.7, < 5.0.127

Fixed in: 5.0.127

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-9p7x-8c57-4pqv

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/09/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui