CVE-2024-26270: 
Java vulnerability analysis and mitigation

CVE-2024-26270 is a security vulnerability discovered in Liferay Portal versions 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92. The vulnerability was disclosed on February 20, 2024, and involves the exposure of users' hashed passwords in the HTML source of the Account Settings page (Liferay Advisory, NVD).

The vulnerability stems from the Account Settings page embedding users' hashed passwords directly in the page's HTML source code. It has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) by NIST with a vector string of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, while Liferay Inc. assessed it with a score of 6.5 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows man-in-the-middle attackers to steal users' hashed passwords by accessing the HTML source of the Account Settings page. This exposure of hashed passwords could potentially lead to unauthorized access if the hashes are successfully cracked (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.100 and Liferay DXP 2023.Q3.5. Users are advised to upgrade to these or later versions to protect against this security issue (Liferay Advisory).