CVE-2022-41414

Vulnerability

The vulnerability stems from an insecure default configuration of the auth.login.prompt.enabled property in Liferay Portal versions 7.0.0 through 7.4.2. By default, this setting enables a login prompt that reveals whether a given username, site name, or page exists, leading to information disclosure [1].

Exploitation

An unauthenticated attacker can exploit this by sending crafted requests to the login endpoint. The prompt’s response differs based on whether the submitted username or resource is valid, allowing the attacker to enumerate valid identifiers without authentication [1].

Impact

Successful enumeration provides an attacker with a list of valid usernames, sites, and pages. This information can be used to launch targeted attacks, such as password guessing or phishing, and increases the attack surface of the portal.

Mitigation

The issue was addressed in a commit that changes the default value of auth.login.prompt.enabled from true to false [3]. Administrators are advised to update to a patched version or manually disable the setting. The official advisory from Liferay provides further guidance [4].