Weak Cryptographic Hash

Liferay Portal is vulnerable to Weak Cryptographic Hash. The vulnerability exists due to the default password hashing algorithm PBKDF2-HMAC-SHA1 having a low work factor in the Liferay Portal. It allows attackers to crack password hashes quickly, potentially compromising user accounts and gaining...

CVE-2024-25607

The CVE-2024-25607 entry affects Liferay Portal 7.2.0–7.4.3.15 and older unsupported versions, and Liferay DXP shown to use PBKDF2-HMAC-SHA1 with a low work factor. This weak default hashing enables attackers to crack password hashes more quickly, posing confidentiality risk. Affected components ...