CVE-2024-26268
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time.
We have discovered 540 live websites that are affected by CVE-2024-26268.
Affected Software
| Product |  Liferay |
| Category | Content Management System |
| Vulnerable Domains | 540 live websites (18% of Liferay install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 25 versions ( 42% of all versions) |
Common Weakness Enumeration
CWE-203 Observable DiscrepancyDetails
- Published - Feb 20, 2024
- Updated - Aug 15, 2024
Credits
- Barnabás Horváth (T4r0) (reporter)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2024-26268 United States | 51 websites |
 Spain | 126 websites |
 Vietnam | 48 websites |
 Italy | 46 websites |
 Iran | 41 websites |
 Brazil | 35 websites |
 Namibia | 29 websites |
 Germany | 26 websites |
 Netherlands | 15 websites |
 Portugal | 12 websites |
Website Distribution by TLD
Number of websites using CVE-2024-26268| .com | 77 websites |
| .es | 73 websites |
| .it | 35 websites |
| .org | 21 websites |
| .de | 20 websites |
| .nl | 14 websites |
| .eu | 8 websites |
| .ca | 7 websites |
| .fi | 7 websites |
| .net | 6 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2024-26268
Top websites that are affected by CVE-2024-26268. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| **********.it | United States | **,*** | |
| ***.sk |  Slovakia | **,*** | |
| ****.***.it | Italy | **,*** | |
| ******.*****.***.hu |  Hungary | **,*** | |
| *******.es | Spain | **,*** | |
| ******.es | Spain | **,*** | |
| *********.org | United States | **,*** | |
| ****.***.it | Italy | **,*** | |
| ***.com | United States | **,*** | |
| ********.***.ar |  Argentina | ***,*** |
FAQ
CVE-2024-26268 is Observable Discrepancy in Liferay
A total of 540 websites have been identified as vulnerable to CVE-2024-26268, based on global website indexing conducted by WebTechSurvey.
The Liferay is affected by the CVE-2024-26268 vulnerability.
Liferay versions up to and including 7.2.10 are vulnerable to CVE-2024-26268.