description: The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password.
problem types: CWE-201 Insertion of Sensitive Information Into Sent Data
affected:
{
defaultStatus: unaffected
product: Portal
vendor: Liferay
versions:
lessThanOrEqual: 7.4.3.99, status: affected, version: 7.4.3.76, versionType: maven
}
{
defaultStatus: unaffected
product: DXP
vendor: Liferay
versions:
lessThanOrEqual: 2023.q3.4, status: affected, version: 2023.q3.1, versionType: maven
lessThanOrEqual: 7.4.13.u92, status: affected, version: 7.4.13.u76, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL