Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.
Weakness
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_experience_platform | Liferay | 2024.Q1.1 (including) | 2024.Q1.15 (excluding) |
| Digital_experience_platform | Liferay | 2024.q2.0 (including) | 2024.q2.13 (including) |
| Digital_experience_platform | Liferay | 2024.Q3.0 (including) | 2024.Q3.13 (including) |
| Digital_experience_platform | Liferay | 2024.q4.0 (including) | 2024.q4.7 (including) |
| Digital_experience_platform | Liferay | 7.4 (including) | 7.4 (including) |
| Digital_experience_platform | Liferay | 7.4-update1 (including) | 7.4-update1 (including) |
| Digital_experience_platform | Liferay | 7.4-update10 (including) | 7.4-update10 (including) |
| Digital_experience_platform | Liferay | 7.4-update11 (including) | 7.4-update11 (including) |
| Digital_experience_platform | Liferay | 7.4-update12 (including) | 7.4-update12 (including) |
| Digital_experience_platform | Liferay | 7.4-update13 (including) | 7.4-update13 (including) |
| Digital_experience_platform | Liferay | 7.4-update14 (including) | 7.4-update14 (including) |
| Digital_experience_platform | Liferay | 7.4-update15 (including) | 7.4-update15 (including) |
| Digital_experience_platform | Liferay | 7.4-update16 (including) | 7.4-update16 (including) |
| Digital_experience_platform | Liferay | 7.4-update17 (including) | 7.4-update17 (including) |
| Digital_experience_platform | Liferay | 7.4-update18 (including) | 7.4-update18 (including) |
| Digital_experience_platform | Liferay | 7.4-update19 (including) | 7.4-update19 (including) |
| Digital_experience_platform | Liferay | 7.4-update2 (including) | 7.4-update2 (including) |
| Digital_experience_platform | Liferay | 7.4-update20 (including) | 7.4-update20 (including) |
| Digital_experience_platform | Liferay | 7.4-update21 (including) | 7.4-update21 (including) |
| Digital_experience_platform | Liferay | 7.4-update22 (including) | 7.4-update22 (including) |
| Digital_experience_platform | Liferay | 7.4-update23 (including) | 7.4-update23 (including) |
| Digital_experience_platform | Liferay | 7.4-update24 (including) | 7.4-update24 (including) |
| Digital_experience_platform | Liferay | 7.4-update25 (including) | 7.4-update25 (including) |
| Digital_experience_platform | Liferay | 7.4-update26 (including) | 7.4-update26 (including) |
| Digital_experience_platform | Liferay | 7.4-update27 (including) | 7.4-update27 (including) |
| Digital_experience_platform | Liferay | 7.4-update28 (including) | 7.4-update28 (including) |
| Digital_experience_platform | Liferay | 7.4-update29 (including) | 7.4-update29 (including) |
| Digital_experience_platform | Liferay | 7.4-update3 (including) | 7.4-update3 (including) |
| Digital_experience_platform | Liferay | 7.4-update30 (including) | 7.4-update30 (including) |
| Digital_experience_platform | Liferay | 7.4-update31 (including) | 7.4-update31 (including) |
| Digital_experience_platform | Liferay | 7.4-update32 (including) | 7.4-update32 (including) |
| Digital_experience_platform | Liferay | 7.4-update33 (including) | 7.4-update33 (including) |
| Digital_experience_platform | Liferay | 7.4-update34 (including) | 7.4-update34 (including) |
| Digital_experience_platform | Liferay | 7.4-update35 (including) | 7.4-update35 (including) |
| Digital_experience_platform | Liferay | 7.4-update36 (including) | 7.4-update36 (including) |
| Digital_experience_platform | Liferay | 7.4-update37 (including) | 7.4-update37 (including) |
| Digital_experience_platform | Liferay | 7.4-update38 (including) | 7.4-update38 (including) |
| Digital_experience_platform | Liferay | 7.4-update39 (including) | 7.4-update39 (including) |
| Digital_experience_platform | Liferay | 7.4-update4 (including) | 7.4-update4 (including) |
| Digital_experience_platform | Liferay | 7.4-update40 (including) | 7.4-update40 (including) |
| Digital_experience_platform | Liferay | 7.4-update41 (including) | 7.4-update41 (including) |
| Digital_experience_platform | Liferay | 7.4-update42 (including) | 7.4-update42 (including) |
| Digital_experience_platform | Liferay | 7.4-update43 (including) | 7.4-update43 (including) |
| Digital_experience_platform | Liferay | 7.4-update44 (including) | 7.4-update44 (including) |
| Digital_experience_platform | Liferay | 7.4-update45 (including) | 7.4-update45 (including) |
| Digital_experience_platform | Liferay | 7.4-update46 (including) | 7.4-update46 (including) |
| Digital_experience_platform | Liferay | 7.4-update47 (including) | 7.4-update47 (including) |
| Digital_experience_platform | Liferay | 7.4-update48 (including) | 7.4-update48 (including) |
| Digital_experience_platform | Liferay | 7.4-update49 (including) | 7.4-update49 (including) |
| Digital_experience_platform | Liferay | 7.4-update5 (including) | 7.4-update5 (including) |
| Digital_experience_platform | Liferay | 7.4-update50 (including) | 7.4-update50 (including) |
| Digital_experience_platform | Liferay | 7.4-update51 (including) | 7.4-update51 (including) |
| Digital_experience_platform | Liferay | 7.4-update52 (including) | 7.4-update52 (including) |
| Digital_experience_platform | Liferay | 7.4-update53 (including) | 7.4-update53 (including) |
| Digital_experience_platform | Liferay | 7.4-update54 (including) | 7.4-update54 (including) |
| Digital_experience_platform | Liferay | 7.4-update55 (including) | 7.4-update55 (including) |
| Digital_experience_platform | Liferay | 7.4-update56 (including) | 7.4-update56 (including) |
| Digital_experience_platform | Liferay | 7.4-update57 (including) | 7.4-update57 (including) |
| Digital_experience_platform | Liferay | 7.4-update58 (including) | 7.4-update58 (including) |
| Digital_experience_platform | Liferay | 7.4-update59 (including) | 7.4-update59 (including) |
| Digital_experience_platform | Liferay | 7.4-update6 (including) | 7.4-update6 (including) |
| Digital_experience_platform | Liferay | 7.4-update60 (including) | 7.4-update60 (including) |
| Digital_experience_platform | Liferay | 7.4-update61 (including) | 7.4-update61 (including) |
| Digital_experience_platform | Liferay | 7.4-update62 (including) | 7.4-update62 (including) |
| Digital_experience_platform | Liferay | 7.4-update63 (including) | 7.4-update63 (including) |
| Digital_experience_platform | Liferay | 7.4-update64 (including) | 7.4-update64 (including) |
| Digital_experience_platform | Liferay | 7.4-update65 (including) | 7.4-update65 (including) |
| Digital_experience_platform | Liferay | 7.4-update66 (including) | 7.4-update66 (including) |
| Digital_experience_platform | Liferay | 7.4-update67 (including) | 7.4-update67 (including) |
| Digital_experience_platform | Liferay | 7.4-update68 (including) | 7.4-update68 (including) |
| Digital_experience_platform | Liferay | 7.4-update69 (including) | 7.4-update69 (including) |
| Digital_experience_platform | Liferay | 7.4-update7 (including) | 7.4-update7 (including) |
| Digital_experience_platform | Liferay | 7.4-update70 (including) | 7.4-update70 (including) |
| Digital_experience_platform | Liferay | 7.4-update71 (including) | 7.4-update71 (including) |
| Digital_experience_platform | Liferay | 7.4-update72 (including) | 7.4-update72 (including) |
| Digital_experience_platform | Liferay | 7.4-update73 (including) | 7.4-update73 (including) |
| Digital_experience_platform | Liferay | 7.4-update74 (including) | 7.4-update74 (including) |
| Digital_experience_platform | Liferay | 7.4-update75 (including) | 7.4-update75 (including) |
| Digital_experience_platform | Liferay | 7.4-update76 (including) | 7.4-update76 (including) |
| Digital_experience_platform | Liferay | 7.4-update77 (including) | 7.4-update77 (including) |
| Digital_experience_platform | Liferay | 7.4-update78 (including) | 7.4-update78 (including) |
| Digital_experience_platform | Liferay | 7.4-update79 (including) | 7.4-update79 (including) |
| Digital_experience_platform | Liferay | 7.4-update8 (including) | 7.4-update8 (including) |
| Digital_experience_platform | Liferay | 7.4-update80 (including) | 7.4-update80 (including) |
| Digital_experience_platform | Liferay | 7.4-update81 (including) | 7.4-update81 (including) |
| Digital_experience_platform | Liferay | 7.4-update82 (including) | 7.4-update82 (including) |
| Digital_experience_platform | Liferay | 7.4-update83 (including) | 7.4-update83 (including) |
| Digital_experience_platform | Liferay | 7.4-update84 (including) | 7.4-update84 (including) |
| Digital_experience_platform | Liferay | 7.4-update85 (including) | 7.4-update85 (including) |
| Digital_experience_platform | Liferay | 7.4-update86 (including) | 7.4-update86 (including) |
| Digital_experience_platform | Liferay | 7.4-update87 (including) | 7.4-update87 (including) |
| Digital_experience_platform | Liferay | 7.4-update88 (including) | 7.4-update88 (including) |
| Digital_experience_platform | Liferay | 7.4-update89 (including) | 7.4-update89 (including) |
| Digital_experience_platform | Liferay | 7.4-update9 (including) | 7.4-update9 (including) |
| Digital_experience_platform | Liferay | 7.4-update90 (including) | 7.4-update90 (including) |
| Digital_experience_platform | Liferay | 7.4-update91 (including) | 7.4-update91 (including) |
| Digital_experience_platform | Liferay | 7.4-update92 (including) | 7.4-update92 (including) |
| Liferay_portal | Liferay | 7.4.0 (including) | 7.4.3.132 (including) |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/462.html
- https://cwe.mitre.org/data/definitions/541.html
- https://cwe.mitre.org/data/definitions/580.html