Insecure handling of authentication information in 6.2.2

• Type: Bug
• Status: Closed
• Resolution: Duplicate
• Affects Version/s: 6.2.2 CE GA3
• Fix Version/s: None
• Component/s: Application Security, Application Security > NTLM, Security Vulnerability, Workflow
• Labels:
  • cst-patch

This ticket covers various issues in the way the portal handles authentication information in Liferay Portal 6.2 CE GA3 that are addressed by the CST patch, including:

• Passwords are transmitted to the user unnecessarily
• Browsers may save answers to reminder questions