CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2024-26270
Medium (5.3) in liferay. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.4.3.100.
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-201
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xq4r-4xfh-vch8 | Maven | com.liferay.portal:release.portal.bom | >=7.4.3.76 <7.4.3.100 | 7.4.3.100 |
| GHSA-xq4r-4xfh-vch8 | Maven | com.liferay.portal:release.dxp.bom | >=2023.Q3 <2023.Q3.5 | 2023.Q3.5 |
| GHSA-xq4r-4xfh-vch8 | Maven | com.liferay.portal:release.dxp.bom | >=7.4.0 <=7.4.13.u92 | no fix published |