Description

User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.

Remediation

References

CVE-2024-26268

Related Vulnerabilities

Oracle JRE CVE-2013-2465 Vulnerability (CVE-2013-2465)

WordPress Plugin Login With Ajax Security Bypass (3.1.2)

PHP Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2007-0455)

Apache HTTP Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-3185)

WordPress Plugin All Video Gallery 'vid' Parameter Multiple SQL Injection Vulnerabilities (1.1)

Severity

Medium

Classification

CVE-2024-26268 CWE-203 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities