Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A recent case study from a closed government information system demonstrates how reliance on Liferay Community Edition can result in exposure of sensitive credentials through a classic CWE-319 flaw.
The system in question handled authentication via external government gateways and used OAuth 2.0 for data exchange. Despite these controls, a custom password-change portlet triggered the platform’s default email notification containing the newly set password in plaintext.
Technical Evidence Found in Message Source
Inspection of the received email headers revealed the default Liferay Inc. MailEngine identifier @events.liferay.com because the property mail.string.id had never been overridden. The subject line still referenced http://localhost:8080, indicating that the global variable [$PORTAL_URL$] remained set to a developer workstation.
The email body itself contained the literal string of the user’s permanent password, placed there by the [$PASSWORD$] macro inside the transactional template.
Root Cause and Configuration Errors
Liferay developers designed the macro exclusively for administrator-initiated account creation, where a temporary password is generated and must be changed on first login. Government engineers reused the same notification trigger for a self-service password change workflow, causing permanent credentials to be emailed in clear text.
The deployment also left test configuration values in the production portal-ext.properties file, allowing the localhost reference to reach live users.
Remediation Steps
- Remove the [$PASSWORD$] macro from both subject and body of the Password Changed Notification template via Control Panel → System Settings → Users.
- Set web.server.host, web.server.https.port, and web.server.protocol to production values.
- Override mail.string.id with the official government domain.
- Restart the application server (Tomcat or WildFly).
The entire hardening process can be completed in minutes without code changes and eliminates the plaintext transmission vector.
Related articles
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.