CVE-2024-26268: 
Java vulnerability analysis and mitigation

A user enumeration vulnerability (CVE-2024-26268) was discovered in Liferay Portal versions 7.2.0 through 7.4.3.26 and Liferay DXP versions affecting 7.4 (before update 27), 7.3 (before update 8), 7.2 (before fix pack 20), and older unsupported versions. The vulnerability was disclosed on February 20, 2024, and was reported by Barnabás Horváth (T4r0) (Liferay Advisory).

The vulnerability allows remote attackers to determine if an account exists in the application by comparing the request's response time. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in low confidentiality impact (NVD).

The vulnerability allows attackers to enumerate valid user accounts in the system by analyzing response time differences. This information disclosure could potentially be used as a stepping stone for further attacks by identifying valid user accounts in the system (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Users should upgrade to the following versions: Liferay Portal 7.4.3.27, Liferay DXP 7.4 update 27, Liferay DXP 7.3 update 8, or Liferay DXP 7.2 fix pack 20 (Liferay Advisory).