CVE-2024-26267: 
Java vulnerability analysis and mitigation

CVE-2024-26267 affects Liferay Portal and Liferay DXP systems, discovered and disclosed on February 20, 2024. The vulnerability exists in multiple versions including Liferay Portal 7.2.0 through 7.4.3.25 and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions (Liferay Advisory).

The vulnerability stems from an insecure default configuration where the portal property http.header.version.verbosity is set to full. This configuration issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-1188 (Insecure Default Initialization of Resource) (NVD).

The vulnerability allows remote attackers to easily identify the version of the application that is running through the 'Liferay-Portal' response header. This information disclosure can help attackers identify specific vulnerabilities that affect the running version (Liferay Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. The attack complexity is low, making it relatively straightforward for attackers to obtain version information through the exposed HTTP header (NVD).

As a workaround, administrators can modify the portal(-ext).properties file to set http.header.version.verbosity=partial. Fixed versions have been released including Liferay Portal 7.4.3.26, Liferay DXP 7.4 update 26, Liferay DXP 7.3 update 5, and Liferay DXP 7.2 fix pack 19 (Liferay Advisory).