GHSA-xq4r-4xfh-vch8

Suggest an improvement
Source
https://github.com/advisories/GHSA-xq4r-4xfh-vch8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-xq4r-4xfh-vch8/GHSA-xq4r-4xfh-vch8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xq4r-4xfh-vch8
Aliases
Published
2024-02-20T15:31:05Z
Modified
2025-01-28T23:42:38.066163Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Liferay Portal and Liferay DXP vulnerable to theft of hashed password
Details

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.

Database specific 
{
    "nvd_published_at": "2024-02-20T14:15:09Z",
    "cwe_ids": [
        "CWE-201"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-28T23:15:23Z"
}
References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name
com.liferay.portal:release.portal.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.4.3.76
Fixed
7.4.3.100

Affected versions

7.*

7.4.3.76
7.4.3.77
7.4.3.78
7.4.3.79
7.4.3.80
7.4.3.81
7.4.3.82
7.4.3.83
7.4.3.84
7.4.3.85
7.4.3.85-ga85
7.4.3.86
7.4.3.87
7.4.3.88
7.4.3.89
7.4.3.90
7.4.3.91
7.4.3.92
7.4.3.93
7.4.3.94
7.4.3.95
7.4.3.95-1
7.4.3.96
7.4.3.97
7.4.3.98
7.4.3.99

Maven / com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2023.Q3
Fixed
2023.Q3.5

Affected versions

2023.*

2023.q3.1
2023.q3.2
2023.q3.3
2023.q3.4

Maven / com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.4.0
Last affected
7.4.13.u92

Affected versions

7.*

7.4.10.ep1
7.4.11
7.4.12
7.4.13
7.4.13.u1
7.4.13.u2
7.4.13.u3
7.4.13.u4
7.4.13.u5
7.4.13.u6
7.4.13.u7
7.4.13.u8
7.4.13.u9
7.4.13.u10
7.4.13.u15
7.4.13.u16
7.4.13.u17
7.4.13.u18
7.4.13.u19
7.4.13.u20
7.4.13.u21
7.4.13.u22
7.4.13.u23
7.4.13.u24
7.4.13.u25
7.4.13.u26
7.4.13.u27
7.4.13.u28
7.4.13.u29
7.4.13.u30
7.4.13.u31
7.4.13.u32
7.4.13.u33
7.4.13.u34
7.4.13.u35
7.4.13.u36
7.4.13.u37
7.4.13.u38
7.4.13.u39
7.4.13.u40
7.4.13.u41
7.4.13.u42
7.4.13.u43
7.4.13.u44
7.4.13.u45
7.4.13.u46
7.4.13.u47
7.4.13.u48
7.4.13.u49
7.4.13.u50
7.4.13.u51
7.4.13.u52
7.4.13.u53
7.4.13.u54
7.4.13.u55
7.4.13.u56
7.4.13.u57
7.4.13.u58
7.4.13.u59
7.4.13.u60
7.4.13.u61
7.4.13.u62
7.4.13.u63
7.4.13.u64
7.4.13.u65
7.4.13.u66
7.4.13.u67
7.4.13.u68
7.4.13.u69
7.4.13.u70
7.4.13.u71
7.4.13.u72
7.4.13.u73
7.4.13.u74
7.4.13.u75
7.4.13.u76
7.4.13.u77
7.4.13.u78
7.4.13.u79
7.4.13.u80
7.4.13.u81
7.4.13.u82
7.4.13.u83
7.4.13.u84
7.4.13.u85
7.4.13.u86
7.4.13.u87
7.4.13.u88
7.4.13.u89
7.4.13.u90
7.4.13.u91
7.4.13.u92