Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-26268

Good to know:

icon
icon

Date: February 20, 2024

User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

Language: Java

Severity Score

Related Resources (6)

https://github.com/liferay/liferay-portal
https://nvd.nist.gov/vuln/detail/CVE-2024-26268
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268
https://github.com/liferay/liferay-portal/commit/46db55ec21103fa39542e2cba080c4f98e3c5f93
https://github.com/liferay/liferay-portal/commit/d8d0ae0178a2d902b541c80a230a2c7a5ab246e8
https://www.mend.io/vulnerability-database/CVE-2024-26268

Severity Score

Weakness Type (CWE)

Observable Discrepancy

CWE-203

Top Fix

icon

Upgrade Version

Upgrade to version com.liferay.portal:release.dxp.bom:7.2.10.fp20;com.liferay.portal:release.dxp.bom:7.3.10.u8;com.liferay.portal:release.dxp.bom:7.4.13.u27

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us