Insecure service configuration In com.liferay.portal:release.portal.bom
Description
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 7.4.2-ga3 | ||
maven | 8.0.0 |
Aliases
1. 2. 3. 4.
References
1. 2.