CVE-2024-26270 – com.liferay.portal:release.dxp.bom

Package

Manager: maven
Name: com.liferay.portal:release.dxp.bom
Vulnerable Version: >=2023.q3 <2023.q3.5 || >=7.4.0 <=7.4.13.u92

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00239 pctl0.46917

Details

Liferay Portal and Liferay DXP vulnerable to theft of hashed password The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Metadata

Created: 2024-02-20T15:31:05Z
Modified: 2025-01-28T23:15:23Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-xq4r-4xfh-vch8/GHSA-xq4r-4xfh-vch8.json
CWE IDs: ["CWE-201"]
Alternative ID: GHSA-xq4r-4xfh-vch8
Finding: F038
Auto approve: 1