Liferay Portal and DXP Vulnerabilities Allow Man-in-the-Middle Attackers to Steal Hashed Passwords
CVE-2024-26270

5.3MEDIUM

Key Information:

Vendor
Liferay
Status
Portal
Dxp
Vendor
CVE Published:
20 February 2024

Summary

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Affected Version(s)

DXP 2023.q3.1 <= 2023.q3.4

DXP 7.4.13.u76 <= 7.4.13.u92

Portal 7.4.3.76 <= 7.4.3.99

References

https://liferay.dev/portal/security/known-vulnerabilities...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.