cve.bz

CVE-2024-25607

7.5 highEPSS 0.3%

High (7.5) in liferay. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.dxp.bom 7.2.10.fp17, 7.3.10.u4, 7.4.13.u16.

The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE
CWE-916
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-43h9-p3j4-39hmMavencom.liferay.portal:release.dxp.bom>=7.3.0 <7.3.10.u47.3.10.u4
GHSA-43h9-p3j4-39hmMavencom.liferay.portal:release.dxp.bom<7.2.10.fp177.2.10.fp17
GHSA-43h9-p3j4-39hmMavencom.liferay.portal:release.dxp.bom>=7.4.0 <7.4.13.u167.4.13.u16
GHSA-43h9-p3j4-39hmMavencom.liferay.portal:release.portal.bom<7.4.3.147.4.3.14
GHSA-43h9-p3j4-39hmMavencom.liferay.portal:com.liferay.portal.kernel<38.0.038.0.0

References

Check your stackJSON