UpHeron
All vulnerabilities

Servers and applications

CVE-2024-26270

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Severity
Medium 5.3
Published
20 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.3.100
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 2023.q3.4
  • Version 2023.q3.3
  • Version 2023.q3.2
  • Version 2023.q3.1
All 22 release lines
  • Version 7.4-update76
  • Version 7.4-update77
  • Version 7.4-update78
  • Version 7.4-update79
  • Version 7.4-update80
  • Version 7.4-update81
  • Version 7.4-update82
  • Version 7.4-update83
  • Version 7.4-update84
  • Version 7.4-update85
  • Version 7.4-update86
  • Version 7.4-update87
  • Version 7.4-update88
  • Version 7.4-update89
  • Version 7.4-update90
  • Version 7.4-update91
  • Version 7.4-update92
  • Version 2023.q3.0
  • Version 2023.q3.1
  • Version 2023.q3.2
  • Version 2023.q3.3
  • Version 2023.q3.4
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • From 7.4.3.76 before 7.4.3.100

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-26270
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-26270