VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Feb 20, 2024· Updated Jun 17, 2026

CVE-2024-26270

CVE-2024-26270

Description

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.3.76, < 7.4.3.1007.4.3.100
com.liferay.portal:release.dxp.bomMaven
>= 2023.Q3, < 2023.Q3.52023.Q3.5
com.liferay.portal:release.dxp.bomMaven
>= 7.4.0, <= 7.4.13.u92—

Affected products

27
  • Liferay/Digital Experience Platform22 versions
    cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*+ 21 more
    • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
    • cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
  • Liferay/Portal2 versions
    cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.3.76,<7.4.3.100
    • (no CPE)range: 7.4.3.76
  • ghsa-coords2 versions
    pkg:maven/com.liferay.portal/release.dxp.bompkg:maven/com.liferay.portal/release.portal.bom
    >= 2023.Q3, < 2023.Q3.5+ 1 more
    • (no CPE)range: >= 2023.Q3, < 2023.Q3.5
    • (no CPE)range: >= 7.4.3.76, < 7.4.3.100
  • Liferay/DXPcpe-rescue
    Range: 2023.q3.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.