CVE-2024-26270CWE-201

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s…

Medium · published February 20, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.4th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2024-02-20T13:43Z
EPSS history
Timeline
  • 20 FEB 13:43Z
    The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s…
    cvelistv5