CVE-2024-25149: 
Java vulnerability analysis and mitigation

CVE-2024-25149 is a security vulnerability discovered in Liferay Portal and Liferay DXP, first disclosed on February 20, 2024. The vulnerability affects Liferay Portal versions 7.2.0 through 7.4.1, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions (Liferay Advisory).

The vulnerability stems from improper authorization controls (CWE-863) in the site membership management system. When the 'Limit membership to members of the parent site' option is enabled, the system fails to properly restrict membership of child sites. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

The vulnerability allows remote authenticated users to add users who are not members of the parent site to a child site. These improperly added users may then obtain permissions to perform unauthorized actions within the child site, potentially compromising the security model of the hierarchical site structure (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal 7.4.2, Liferay DXP 7.3 service pack 3, and Liferay DXP 7.2 fix pack 15. Organizations using affected versions should upgrade to these patched versions to mitigate the vulnerability (Liferay Advisory).