CVE-2024-26270
5.3
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.6 / Impact: 3.6
Source: NVD
Description
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
Affected (23)
Products: Liferay: Liferay Portal, Digital Experience Platform
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 7.4.3.76 to 7.4.3.100 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 2023.q3.0 |
References (2)
Source: security@liferay.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.