GitHub Advisoryadvisory · Maven

GHSA-xq4r-4xfh-vch8 Liferay Portal and Liferay DXP vulnerable to theft of hashed password

MEDIUM Published 2024-02-20 Modified 2025-01-28 Official page ↗
Aliases
CVE-2024-26270
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201
Reviewed
2025-01-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.76, < 7.4.3.100 → fixed in 7.4.3.100 • Maven com.liferay.portal:release.dxp.bom: >= 2023.Q3, < 2023.Q3.5 → fixed in 2023.Q3.5 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.0, <= 7.4.13.u92 (no fix yet)

Description

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Related

Alias · CVE (1)

  • CVE-2024-26270 The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References