CVE-2024-26270 - Vulnerability Details

Vendors	Products
Liferay	Digital Experience Platform Liferay Portal

Link	Providers
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270

Type	Values Removed	Values Added
First Time appeared		Liferay Liferay digital Experience Platform Liferay liferay Portal
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:::::::* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:::::::* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:::::::* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:::::::* cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:::::::* cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:::::: cpe:2.3:a:liferay:liferay_portal::::::::
Vendors & Products		Liferay Liferay digital Experience Platform Liferay liferay Portal

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26270", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2024-02-15T07:44:36.776Z", "datePublished": "2024-02-20T13:43:46.074Z", "dateUpdated": "2024-08-16T19:55:12.801Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.99", "status": "affected", "version": "7.4.3.76", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "2023.q3.4", "status": "affected", "version": "2023.q3.1", "versionType": "maven"}, {"lessThanOrEqual": "7.4.13.u92", "status": "affected", "version": "7.4.13.u76", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password."}], "value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-20T13:43:46.074Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.056Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-16T19:55:04.883437Z", "id": "CVE-2024-26270", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T19:55:12.801Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-26270 (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

state : PUBLISHED (string)

assignerShortName : Liferay (string)

dateReserved : 2024-02-15T07:44:36.776Z (string)

datePublished : 2024-02-20T13:43:46.074Z (string)

dateUpdated : 2024-08-16T19:55:12.801Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Portal (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.4.3.99 (string)

status : affected (string)

version : 7.4.3.76 (string)

versionType : maven (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : DXP (string)

vendor : Liferay (string)

versions : [ »

0 : { »

lessThanOrEqual : 2023.q3.4 (string)

status : affected (string)

version : 2023.q3.1 (string)

versionType : maven (string)

}

1 : { »

lessThanOrEqual : 7.4.13.u92 (string)

status : affected (string)

version : 7.4.13.u76 (string)

versionType : maven (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. (string)

}

]

value : The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-201 (string)

description : CWE-201 Insertion of Sensitive Information Into Sent Data (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2024-02-20T13:43:46.074Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:07:19.056Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-16T19:55:04.883437Z (string)

id : CVE-2024-26270 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-16T19:55:12.801Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.056Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-16T19:55:04.883437Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T19:55:09.342Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.4.3.76", "versionType": "maven", "lessThanOrEqual": "7.4.3.99"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "2023.q3.1", "versionType": "maven", "lessThanOrEqual": "2023.q3.4"}, {"status": "affected", "version": "7.4.13.u76", "versionType": "maven", "lessThanOrEqual": "7.4.13.u92"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.", "supportingMedia": [{"type": "text/html", "value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-02-20T13:43:46.074Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26270", "state": "PUBLISHED", "dateUpdated": "2024-08-16T19:55:12.801Z", "dateReserved": "2024-02-15T07:44:36.776Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2024-02-20T13:43:46.074Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T00:07:19.056Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-26270 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-16T19:55:04.883437Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-16T19:55:09.342Z (string)

}

]

cna : { »

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Liferay (string)

product : Portal (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.4.3.76 (string)

versionType : maven (string)

lessThanOrEqual : 7.4.3.99 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : Liferay (string)

product : DXP (string)

versions : [ »

0 : { »

status : affected (string)

version : 2023.q3.1 (string)

versionType : maven (string)

lessThanOrEqual : 2023.q3.4 (string)

}

1 : { »

status : affected (string)

version : 7.4.13.u76 (string)

versionType : maven (string)

lessThanOrEqual : 7.4.13.u92 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-201 (string)

description : CWE-201 Insertion of Sensitive Information Into Sent Data (string)

}

]

}

]

providerMetadata : { »

orgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

shortName : Liferay (string)

dateUpdated : 2024-02-20T13:43:46.074Z (string)

}

cveMetadata : { »

cveId : CVE-2024-26270 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-16T19:55:12.801Z (string)

dateReserved : 2024-02-15T07:44:36.776Z (string)

assignerOrgId : 8b54e794-c6f0-462e-9faa-c1001a673ac3 (string)

datePublished : 2024-02-20T13:43:46.074Z (string)

assignerShortName : Liferay (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DB383E5-7A0E-46A2-AB91-E4536889A6DB", "versionEndExcluding": "7.4.3.100", "versionStartIncluding": "7.4.3.76", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*", "matchCriteriaId": "7E325115-EEBC-41F4-8606-45270DA40B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*", "matchCriteriaId": "848B2C72-447D-46E2-A5A7-43CF3764E578", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*", "matchCriteriaId": "26A0AF15-52A9-46FD-8157-359141332EAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*", "matchCriteriaId": "63D63872-C1D0-444F-BCC7-A514F323C256", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*", "matchCriteriaId": "9D9FA9AD-39D3-412A-B794-E1B29EEEEC4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*", "matchCriteriaId": "294D8A56-A797-433C-A06E-106B2179151A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*", "matchCriteriaId": "824D88D9-4645-4CAD-8CAB-30F27DD388C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*", "matchCriteriaId": "F6E8C952-B455-46E4-AC3D-D38CAF189F60", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*", "matchCriteriaId": "CD77C0EE-AC79-4443-A502-C1E02F806911", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*", "matchCriteriaId": "648EB53C-7A90-4DA6-BF1C-B5336CDE30C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*", "matchCriteriaId": "39835EF7-8E93-4695-973D-6E9B76C67372", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*", "matchCriteriaId": "2A05FB86-332B-44E3-93CB-82465A38976E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*", "matchCriteriaId": "7C754823-899C-4EEF-ACB7-E1551FA88B25", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*", "matchCriteriaId": "493D4C18-DEE2-4040-9C13-3A9AB2CE47BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*", "matchCriteriaId": "8F17DD75-E63B-4E4C-B136-D43F17B389EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*", "matchCriteriaId": "62EE759A-78AD-40D6-8C5B-10403A8A4A89", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*", "matchCriteriaId": "865ABA1F-CA99-4602-B325-F81C9778855C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:*", "matchCriteriaId": "B7B3A5E2-23CE-45A8-BD01-77024EB9F9A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:*", "matchCriteriaId": "1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:*", "matchCriteriaId": "9D6CE430-3C95-4855-BA44-E2E136D1FEB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:*", "matchCriteriaId": "44FEB149-C792-493D-B055-568FFC96298A", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:*", "matchCriteriaId": "B050DD73-71B6-46CD-A35B-7ACB53BE6C6A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user\u2019s hashed password in the page\u2019s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password."}, {"lang": "es", "value": "La p\u00e1gina Configuraci\u00f3n de Cuenta en Liferay Portal 7.4.3.76 a 7.4.3.99, y Liferay DXP 2023.Q3 antes del parche 5, y 7.4 actualizaci\u00f3n 76 a 92 incorpora la contrase\u00f1a hash del usuario en el c\u00f3digo fuente HTML de la p\u00e1gina, lo que permite al hombre en el atacantes intermedios para robar la contrase\u00f1a hash de un usuario."}], "id": "CVE-2024-26270", "lastModified": "2025-01-28T21:25:41.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@liferay.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-20T14:15:09.530", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "security@liferay.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2DB383E5-7A0E-46A2-AB91-E4536889A6DB (string)

versionEndExcluding : 7.4.3.100 (string)

versionStartIncluding : 7.4.3.76 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* (string)

matchCriteriaId : 7E325115-EEBC-41F4-8606-45270DA40B98 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:* (string)

matchCriteriaId : 848B2C72-447D-46E2-A5A7-43CF3764E578 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:* (string)

matchCriteriaId : 26A0AF15-52A9-46FD-8157-359141332EAF (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:* (string)

matchCriteriaId : 63D63872-C1D0-444F-BCC7-A514F323C256 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:* (string)

matchCriteriaId : 9D9FA9AD-39D3-412A-B794-E1B29EEEEC4A (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* (string)

matchCriteriaId : 294D8A56-A797-433C-A06E-106B2179151A (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* (string)

matchCriteriaId : 824D88D9-4645-4CAD-8CAB-30F27DD388C4 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* (string)

matchCriteriaId : F6E8C952-B455-46E4-AC3D-D38CAF189F60 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* (string)

matchCriteriaId : CD77C0EE-AC79-4443-A502-C1E02F806911 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* (string)

matchCriteriaId : 648EB53C-7A90-4DA6-BF1C-B5336CDE30C7 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* (string)

matchCriteriaId : 39835EF7-8E93-4695-973D-6E9B76C67372 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:* (string)

matchCriteriaId : 2A05FB86-332B-44E3-93CB-82465A38976E (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:* (string)

matchCriteriaId : 7C754823-899C-4EEF-ACB7-E1551FA88B25 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:* (string)

matchCriteriaId : 493D4C18-DEE2-4040-9C13-3A9AB2CE47BF (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:* (string)

matchCriteriaId : 8F17DD75-E63B-4E4C-B136-D43F17B389EF (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:* (string)

matchCriteriaId : 62EE759A-78AD-40D6-8C5B-10403A8A4A89 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:* (string)

matchCriteriaId : 865ABA1F-CA99-4602-B325-F81C9778855C (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:2023.q3.0:*:*:*:*:*:*:* (string)

matchCriteriaId : B7B3A5E2-23CE-45A8-BD01-77024EB9F9A9 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 1EF6451A-2A5D-4222-A1C6-113AA4B8D4E6 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 9D6CE430-3C95-4855-BA44-E2E136D1FEB2 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 44FEB149-C792-493D-B055-568FFC96298A (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4:*:*:*:*:*:*:* (string)

matchCriteriaId : B050DD73-71B6-46CD-A35B-7ACB53BE6C6A (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. (string)

}

1 : { »

lang : es (string)

value : La página Configuración de Cuenta en Liferay Portal 7.4.3.76 a 7.4.3.99, y Liferay DXP 2023.Q3 antes del parche 5, y 7.4 actualización 76 a 92 incorpora la contraseña hash del usuario en el código fuente HTML de la página, lo que permite al hombre en el atacantes intermedios para robar la contraseña hash de un usuario. (string)

}

]

id : CVE-2024-26270 (string)

lastModified : 2025-01-28T21:25:41.420 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : security@liferay.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-02-20T14:15:09.530 (string)

references : [ »

0 : { »

source : security@liferay.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 (string)

}

]

sourceIdentifier : security@liferay.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-201 (string)

}

]

source : security@liferay.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-Other (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object