CVE-2024-26270
published 2024-02-20CVE-2024-26270: The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s…
PriorityP428medium5.3CVSS 3.1
AVNACHPRLUINSUCHINAN
EPSS
0.44%
35.8th percentile
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | digital_experience_platform | — | — |
| liferay | dxp | 2023.q3.1 – 2023.q3.4 | — |
| liferay | dxp | 7.4.13.u76 – 7.4.13.u92 | — |
| liferay | liferay_portal | >= 7.4.3.76 < 7.4.3.100 | 7.4.3.100 |
| liferay | portal | 7.4.3.76 – 7.4.3.99 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
osv·2024-02-20
CVE-2024-26270 [MEDIUM] Liferay Portal and Liferay DXP vulnerable to theft of hashed password
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
GHSA
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
ghsa·2024-02-20
CVE-2024-26270 [MEDIUM] CWE-201 Liferay Portal and Liferay DXP vulnerable to theft of hashed password
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-20
Published