Description
Liferay Portal and Liferay DXP allows unauthenticated users with valid credentials to bypass the login process by changing the POST method to GET, once the site has MFA enabled.
Severity
2.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L)
Affected Version(s)
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q1.0 through 2025.Q1.6
- Liferay DXP 2024.Q4.0 through 2024.Q4.7
- Liferay DXP 2024.Q3.1 through 2024.Q3.13
- Liferay DXP 2024.Q2.1 through 2024.Q2.13
- Liferay DXP 2024.Q1.1 through 2024.Q1.15
- Liferay DXP 7.4 GA through update 92
- Liferay DXP 7.3 GA through update 36
Fixed Version(s)
- Liferay Portal fixed on master branch
- Liferay DXP 2025.Q2.0
- Liferay DXP 2025.Q1.7
- Liferay DXP 2024.Q1.16
Publication date: Thu, 08 May 2025 17:23:00 +0000