CVE-2024-25605: 
Java vulnerability analysis and mitigation

CVE-2024-25605 is a security vulnerability discovered in the Journal module of Liferay Portal (versions 7.2.0 through 7.4.3.4) and Liferay DXP (version 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions). The vulnerability was disclosed on February 20, 2024, and involves incorrect default permissions that grant guest users view access to web content templates (Liferay Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is classified as CWE-276 (Incorrect Default Permissions). The vulnerability allows remote attackers to view any template through either the user interface or API due to improper default permission settings (NVD).

The vulnerability allows unauthorized remote attackers to view any web content template in the affected Liferay installations. This could potentially lead to the exposure of sensitive template configurations or business logic (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.5, Liferay DXP 7.4 update 1, Liferay DXP 7.3 service pack 3, and Liferay DXP 7.2 fix pack 17. Users are advised to upgrade to these or later versions to address the vulnerability (Liferay Advisory).