CVE-2024-26270

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26270
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 Vendor Advisory
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*
History

28 Jan 2025, 21:25

Type Values Removed Values Added
First Time Liferay digital Experience Platform
Liferay liferay Portal
Liferay
CWE NVD-CWE-Other
References () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 - () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 - Vendor Advisory
CPE cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*

21 Nov 2024, 09:02

Type Values Removed Values Added
Summary
  • (es) La página Configuración de Cuenta en Liferay Portal 7.4.3.76 a 7.4.3.99, y Liferay DXP 2023.Q3 antes del parche 5, y 7.4 actualización 76 a 92 incorpora la contraseña hash del usuario en el código fuente HTML de la página, lo que permite al hombre en el atacantes intermedios para robar la contraseña hash de un usuario.
References () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 - () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 -

20 Feb 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-20 14:15

Updated : 2025-01-28 21:25

NVD link : CVE-2024-26270

Mitre link : CVE-2024-26270

CVE.ORG link : CVE-2024-26270

JSON object : View

Products Affected

liferay

  • liferay_portal
  • digital_experience_platform
CWE
CWE-201

Insertion of Sensitive Information Into Sent Data

NVD-CWE-Other