VYPR
← All advisories
High severity8.1NVD Advisory· Published Feb 20, 2024· Updated Jun 17, 2026

CVE-2024-25607

CVE-2024-25607

Description

The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.dxp.bomMaven
>= 7.3.0, < 7.3.10.u47.3.10.u4
com.liferay.portal:release.dxp.bomMaven
< 7.2.10.fp177.2.10.fp17
com.liferay.portal:release.dxp.bomMaven
>= 7.4.0, < 7.4.13.u167.4.13.u16
com.liferay.portal:release.portal.bomMaven
< 7.4.3.147.4.3.14
com.liferay.portal:com.liferay.portal.kernelMaven
< 38.0.038.0.0

Affected products

51
  • Liferay/Digital Experience Platform45 versions
    cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 44 more
    • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: <7.2
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_16:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_17:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.2:service_pack_5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: <=7.4.3.15
    • (no CPE)range: 7.2.0
  • ghsa-coords3 versions
    pkg:maven/com.liferay.portal/com.liferay.portal.kernelpkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay.portal/release.portal.bom
    < 38.0.0+ 2 more
    • (no CPE)range: < 38.0.0
    • (no CPE)range: >= 7.3.0, < 7.3.10.u4
    • (no CPE)range: < 7.4.3.14
  • Liferay/DXPcpe-rescue
    Range: 7.4.13

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.