CVE-2024-25607 — Use of Password Hash With Insufficient Computational Effort in Digital Experience Platform

CWE-916 — Use of Password Hash With Insufficient Computational Effort4 documents4 sources
Severity
7.5HIGHNVD
CNA8.1
EPSS
0.1%
top 72.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay DXPLiferay Portal+1 more
Timeline
PublishedFeb 20

Description

The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5liferay/portal7.2.0 — 7.4.3.15
▶CVEListV5liferay/dxp7.4.13 — 7.4.13.u15+2

🔴Vulnerability Details

3
CVEList
CVE-2024-25607: The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7↗2024-02-20
▶
GHSA
Liferay Portal defaults to a low work factor for the default password hashing algorithm↗2024-02-20
▶
OSV
Liferay Portal defaults to a low work factor for the default password hashing algorithm↗2024-02-20
▶
CVE-2024-25607 — HIGH severity | cvebase