CVE-2024-25607: High severity Liferay Digital Experience Platform vulnerability
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:com.liferay.portal.kernelto a version that resolves this vulnerability.Fixed in 38.0.0 - Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.14 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.4.13.u16 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.2.10.fp17 - Upgrade
Upgrade
maven/com.liferay.portal:release.dxp.bomto a version that resolves this vulnerability.Fixed in 7.3.10.u4
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25607?
CVE-2024-25607 is classified as a medium severity vulnerability due to the low work factor used in the PBKDF2-HMAC-SHA1 password hashing algorithm.
How do I fix CVE-2024-25607?
To fix CVE-2024-25607, upgrade to Liferay Portal version 7.4.3.15 or above, or Liferay DXP version 7.4 update 16, 7.3 update 4, or 7.2 fix pack 17.
Which versions are affected by CVE-2024-25607?
CVE-2024-25607 affects Liferay Portal versions 7.2.0 to 7.4.3.15 and older unsupported versions, as well as Liferay DXP versions 7.4 before update 16, 7.3 before update 4, and 7.2 before fix pack 17.
What is the impact of exploiting CVE-2024-25607?
Exploiting CVE-2024-25607 can allow attackers to compromise user accounts through weak password hashing.
Is there a workaround for CVE-2024-25607?
A temporary workaround for CVE-2024-25607 may include enhancing password security by implementing stronger password policies or using alternative hashing algorithms until an upgrade can be completed.