Home

CVE-2024-26268

Description

User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the requests response time.

Risk Information

Base Score
5.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
Exploitation Probability
0.304

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2024-25606,CVE-2024-26268 are fixed in Liferay - release.dxp.bom 7.2.10Windows
Vulnerabilities CVE-2024-26268,CVE-2022-42119 are fixed in Liferay - release.dxp.bom 7.3.10Windows
Vulnerabilities CVE-2024-25144,CVE-2024-26268 are fixed in Liferay - release.dxp.bom 7.4.13Windows
Vulnerabilities CVE-2024-26268 are fixed in Liferay - release.portal.bom 7.4.3.27Windows
Vulnerabilities CVE-2024-25606,CVE-2024-26268 are fixed in Liferay - release.dxp.bom for Linux 7.2.10Linux
Vulnerabilities CVE-2024-26268,CVE-2022-42119 are fixed in Liferay - release.dxp.bom for Linux 7.3.10Linux
Vulnerabilities CVE-2024-25144,CVE-2024-26268 are fixed in Liferay - release.dxp.bom for Linux 7.4.13Linux
Vulnerabilities CVE-2024-26268 are fixed in Liferay - release.portal.bom for Linux 7.4.3.27Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234