CVE-2024-26267 json
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions
published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-2mvj-q2q3-wxjv , EUVD-2024-23541
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header.
Patch / fix
- maven com.liferay.portal:release.portal.bom 7.4.3.26-ga26
- maven com.liferay.portal:release.dxp.bom 7.2.10.fp19, 7.3.10.u5, 7.4.13.u26
- liferay liferay_portal 7.4.3.26
- liferay digital_experience_platform 7.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | >=7.2.0, <7.4.3.26-ga26 |
7.4.3.26-ga26 |
| maven | com.liferay.portal:release.dxp.bom | <7.2.10.fp19 >=7.3.0, <7.3.10.u5 >=7.4.0, <7.4.13.u26 |
7.2.10.fp19 7.3.10.u5 7.4.13.u26 |
Affected products
- Liferay Portal
- Liferay DXP
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
github.com
/liferay/liferay-portal/commit/00750dade0cc81efc380fcc6d7e2f58060c4ad95
web
-
github.com
/liferay/liferay-portal/commit/0e881cac66db14a11673c0352def6df04f77d35c
web
-
github.com
/liferay/liferay-portal/commit/9658cec331feaaaad8bf93c6f65e1768a1f43ae2
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-26267
advisory
-
github.com
/liferay/liferay-portal
package
Sources
- CVE List CVE-2024-26267
- GitHub Advisory GHSA-2mvj-q2q3-wxjv
- NVD CVE-2024-26267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.