Maven package
com.liferay/com.liferay.login.web
pkg:maven/com.liferay/com.liferay.login.web
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-43751 | — | < 6.0.66 | 6.0.66 | Aug 22, 2025 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA t | ||
| CVE-2021-29038 | — | < 5.0.18 | 5.0.18 | Feb 20, 2024 | Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder | ||
| CVE-2017-12646 | Med | 6.1 | < 1.1.20 | 1.1.20 | Aug 7, 2017 | XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address. |
- CVE-2025-43751Aug 22, 2025affected < 6.0.66fixed 6.0.66
User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA t
- CVE-2021-29038Feb 20, 2024affected < 5.0.18fixed 5.0.18
Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder
- affected < 1.1.20fixed 1.1.20
XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.