CVE-2024-26270
First published: Tue Feb 20 2024(Updated: )
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
Credit: security@liferay.com security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.liferay.portal:release.dxp.bom | >=7.4.0<=7.4.13.u92 | |
| maven/com.liferay.portal:release.dxp.bom | >=2023.Q3<2023.Q3.5 | 2023.Q3.5 |
| maven/com.liferay.portal:release.portal.bom | >=7.4.3.76<7.4.3.100 | 7.4.3.100 |
| Liferay 7.4 GA | >=7.4.3.76<=7.4.3.99>=7.4 | |
| Liferay 7.4 GA | <2023.Q3 patch 5 | |
| Liferay 7.4 GA | >=7.4.3.76<=7.4.3.92 | |
| Liferay 7.4 GA | >=7.4.3.76<7.4.3.100 | |
| Liferay DXP | =7.4-update76 | |
| Liferay DXP | =7.4-update77 | |
| Liferay DXP | =7.4-update78 | |
| Liferay DXP | =7.4-update79 | |
| Liferay DXP | =7.4-update80 | |
| Liferay DXP | =7.4-update81 | |
| Liferay DXP | =7.4-update82 | |
| Liferay DXP | =7.4-update83 | |
| Liferay DXP | =7.4-update84 | |
| Liferay DXP | =7.4-update85 | |
| Liferay DXP | =7.4-update86 | |
| Liferay DXP | =7.4-update87 | |
| Liferay DXP | =7.4-update88 | |
| Liferay DXP | =7.4-update89 | |
| Liferay DXP | =7.4-update90 | |
| Liferay DXP | =7.4-update91 | |
| Liferay DXP | =7.4-update92 | |
| Liferay DXP | =2023.q3.0 | |
| Liferay DXP | =2023.q3.1 | |
| Liferay DXP | =2023.q3.2 | |
| Liferay DXP | =2023.q3.3 | |
| Liferay DXP | =2023.q3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26270?
CVE-2024-26270 is categorized as a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2024-26270?
To remediate CVE-2024-26270, update Liferay Portal to version 7.4.3.100 or later and Liferay DXP to version 2023.Q3.5 or later.
What is the impact of CVE-2024-26270?
The impact of CVE-2024-26270 is that it allows attackers to steal a user's hashed password if they can intercept the web traffic.
Which Liferay versions are affected by CVE-2024-26270?
CVE-2024-26270 affects Liferay Portal versions 7.4.3.76 to 7.4.3.99 and Liferay DXP 2023.Q3 before patch 5.
Is CVE-2024-26270 a local or remote vulnerability?
CVE-2024-26270 is a remote vulnerability because it can be exploited over the network without physical access to the targeted system.
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xq4r-4xfh-vch8
- alias/CVE-2024-26270
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/references
- agent/source
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- package-manager/maven
- vendor/liferay
- canonical/liferay 7.4 ga
- version/liferay 7.4 ga/7.4.3.76
- canonical/liferay dxp
- version/liferay dxp/7.4-update76
- version/liferay dxp/7.4-update77
- version/liferay dxp/7.4-update78
- version/liferay dxp/7.4-update79
- version/liferay dxp/7.4-update80
- version/liferay dxp/7.4-update81
- version/liferay dxp/7.4-update82
- version/liferay dxp/7.4-update83
- version/liferay dxp/7.4-update84
- version/liferay dxp/7.4-update85
- version/liferay dxp/7.4-update86
- version/liferay dxp/7.4-update87
- version/liferay dxp/7.4-update88
- version/liferay dxp/7.4-update89
- version/liferay dxp/7.4-update90
- version/liferay dxp/7.4-update91
- version/liferay dxp/7.4-update92
- version/liferay dxp/2023.q3.0
- version/liferay dxp/2023.q3.1
- version/liferay dxp/2023.q3.2
- version/liferay dxp/2023.q3.3
- version/liferay dxp/2023.q3.4