CVE-2022-41414: Liferay Portal

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.

Affected products

• Liferay Liferay Portal: from 7.0.0, up to and including 7.4.2

Published 2022-10-07. Last modified 2026-06-17.