CVE-2024-26270
Medium
Description
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Liferay Portal
PublishedFeb 20, 2024
First seenFeb 20, 2024
Weakness typeCWE-201CWE-201
How to fix
Update
- liferay liferay_portal7.4.3.100 or later
- com.liferay.portal:release.portal.bom7.4.3.100 or later
- com.liferay.portal:release.dxp.bom2023.Q3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| liferay liferay_portal | 7.4.3.76 ≤ v < 7.4.3.100 | 7.4.3.100 |
| liferay digital_experience_platform | 7.4, 2023.q3.0, 2023.q3.1, 2023.q3.2, 2023.q3.3, 2023.q3.4 | — |
| com.liferay.portal:release.portal.bomMaven | 7.4.3.76 ≤ v < 7.4.3.100 | 7.4.3.100 |
| com.liferay.portal:release.dxp.bomMaven | 2023.Q3 ≤ v < 2023.Q3.5, 7.4.0 ≤ v ≤ 7.4.13.u92 | 2023.Q3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.