CVE-2024-25607CWE-916

The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before…

High · published February 20, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions defaults to a low work factor, which allows attackers to quickly crack password hashes.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-916 · Use of Password Hash With Insufficient Computational Effort
Published
2024-02-20T09:17Z
EPSS history
Timeline
  • 20 FEB 09:17Z
    The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before…
    cvelistv5