Weak Cryptographic Hash

🗓️ 20 Mar 2024 05:40:33Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 14 Views

Liferay Portal vulnerable to Weak Cryptographic Hash due to low work factor in default password hashing algorithm. Allows quick cracking of password hashes, compromising user accounts and gaining unauthorized access to sensitive data.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-25607	20 Feb 202411:26	–	circl
CNNVD	Liferay Portal and Liferay DXP Security Vulnerabilities	20 Feb 202400:00	–	cnnvd
CVE	CVE-2024-25607	20 Feb 202409:17	–	cve
Cvelist	CVE-2024-25607	20 Feb 202409:17	–	cvelist
EUVD	EUVD-2024-0777	3 Oct 202520:07	–	euvd
Github Security Blog	Liferay Portal defaults to a low work factor for the default password hashing algorithm	20 Feb 202412:31	–	github
NVD	CVE-2024-25607	20 Feb 202410:15	–	nvd
OSV	CVE-2024-25607	20 Feb 202410:15	–	osv
OSV	GHSA-43H9-P3J4-39HM Liferay Portal defaults to a low work factor for the default password hashing algorithm	20 Feb 202412:31	–	osv
Prion	Default credentials	20 Feb 202410:15	–	prion

Vulners

Node

liferay release.portal.bomRange7.2.0–7.2.1-1java

liferay release.portal.bomRange7.3.0–7.3.7java

liferay release.portal.bomRange7.4.0–7.4.3.13java

liferay release.dxp.apiRange7.2.10.fp1–7.2.10.fp16java

liferay release.dxp.apiRange7.3.10-ep4–7.3.10-ga1-2java

liferay release.dxp.apiRange7.4.10-ep1–7.4.13.u15java

liferay release.dxp.bomRange7.2.1–7.2.10.fp16java

liferay release.dxp.bomRange7.3.10.ep3–7.3.10.fp2java

liferay release.dxp.bomRange7.4.10.ep1–7.4.13.u15java

liferay release.portal.apiRange7.2.0–7.2.1-ga2java

liferay release.portal.apiRange7.3.0-ga1–7.3.7-ga8java

liferay release.portal.apiRange7.4.0-ga1–7.4.3.13-ga13java

Source	Link
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25607
github	www.github.com/advisories/GHSA-43h9-p3j4-39hm

22 Mar 2024 08:25Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5 - 8.1

EPSS0.00101

SSVC