WaratekVRT Sign in

CVE-2024-26270 Liferay Portal

Affected softwareLiferay Portal
Severity6.5 Medium CVSS 3.1 2 scores
Fixed in7.4.3.100
WeaknessCWE-201
Published20 Feb 2024
Updated17 Jun 2026

Description

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.44% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Medium or Low severity, no CISA or VulnCheck KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory
Finding This CVE is MEDIUM severity, is not listed in CISA KEV or VulnCheck KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain.

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N security@liferay.com Secondary published
CVSS 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
com.liferay.portal:release.portal.bom 7.4.3.76 7.4.3.100 unbounded
com.liferay.portal:release.dxp.bom 2023.Q3 2023.Q3.5 unbounded
com.liferay.portal:release.dxp.bom 7.4.0 none 7.4.13.u92

Products and versions

4 products, 26 version entries
SourceVendorProductSchemeAffected versions
osv com.liferay.portal release.dxp.bom generic ≥ 7.4.0 and ≤ 7.4.13.92 · ≥ 2023.3 and ＜ 2023.3.5
osv com.liferay.portal release.portal.bom generic ≥ 7.4.3.76 and ＜ 7.4.3.100
nvd liferay digital experience platform generic 7.4:update76 · 7.4:update77 · 7.4:update78 · 7.4:update79 · 7.4:update80 · 7.4:update81 · 7.4:update82 · 7.4:update83 · 7.4:update84 · 7.4:update85 · 7.4:update86 · 7.4:update87 · 7.4:update88 · 7.4:update89 · 7.4:update90 · 7.4:update91 · 7.4:update92 · 2023.q3.0 · 2023.q3.1 · 2023.q3.2 · 2023.q3.3 · 2023.q3.4
nvd liferay liferay portal generic ≥ 7.4.3.76 and ＜ 7.4.3.100

References

URLTags
https://github.com/liferay/liferay-portal PACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 WEB

Timeline
Published2024-02-20By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.