Is CVE-2024-25146 actively exploited?

No active exploitation of CVE-2024-25146 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-25146 be exploited remotely?

Yes. CVE-2024-25146 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-25146?

CVE-2024-25146 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2024-25146

MEDIUM

CVE-2024-25146

CWE-204Published: February 8, 2024· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs. This vulnerability occurs if locale.prepend.friendly.url.style=2 and if a custom 404 page is used.

NVD Source

Technical Analysis

CVE-2024-25146 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.