Description
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | < 8.0.0 | 8.0.0 | GHSA-9427-7f65-88c8 |
| Maven | com.liferay.portal:release.portal.bom | >= 7.0.0-a1, < 7.4.2-ga3 | 7.4.2-ga3 | GHSA-9427-7f65-88c8 |