CVE-2024-26270

liferay portal, liferay digital experience platform

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-26270

Katalog CVE

CVSS 5.3 · Medium EPSS 0,44%

Kerentanan Insertion of Sensitive Information Into Sent Data pada liferay portal, liferay digital experience platform. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Rincian

Terbit di NVD
20 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-201: Insertion of Sensitive Information Into Sent Data
EPSS (30 hari)
0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
liferay liferay portal Versi 7.4.3.76 hingga sebelum 7.4.3.100
liferay digital experience platform Versi 7.4 update76
liferay digital experience platform Versi 7.4 update77
liferay digital experience platform Versi 7.4 update78
liferay digital experience platform Versi 7.4 update79
liferay digital experience platform Versi 7.4 update80
liferay digital experience platform Versi 7.4 update81
liferay digital experience platform Versi 7.4 update82
liferay digital experience platform Versi 7.4 update83
liferay digital experience platform Versi 7.4 update84
liferay digital experience platform Versi 7.4 update85
liferay digital experience platform Versi 7.4 update86
liferay digital experience platform Versi 7.4 update87
liferay digital experience platform Versi 7.4 update88
liferay digital experience platform Versi 7.4 update89
liferay digital experience platform Versi 7.4 update90
liferay digital experience platform Versi 7.4 update91
liferay digital experience platform Versi 7.4 update92
liferay digital experience platform Versi 2023.q3.0
liferay digital experience platform Versi 2023.q3.1
liferay digital experience platform Versi 2023.q3.2
liferay digital experience platform Versi 2023.q3.3
liferay digital experience platform Versi 2023.q3.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.