Liferay Portal versions 7.4.0 through 7.4.3.119 and certain Liferay DXP versions are vulnerable to a password enumeration flaw. This vulnerability allows remote attackers to determine valid user passwords via brute force attacks, even when account lockout mechanisms are enabled. The issue affects multiple versions including 7.4 GA through update 92 and specific quarterly releases of Liferay DXP. A fix is available in version 7.4.3.120.