PT-2021-18040 · Liferay · Liferay Dxp

Published 2021-05-16 · Updated 2022-05-24 · CVE-2021-29041

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Liferay DXP version 7.3 before fix pack 1

Description: A denial-of-service issue exists in the Multi-Factor Authentication module, allowing remote authenticated attackers to prevent user authentication. This can be achieved by either enabling Time-based One-time password (TOTP) on behalf of another user or modifying the TOTP shared secret of another user.

Recommendations: For Liferay DXP version 7.3 before fix pack 1, apply fix pack 1 to resolve the issue. As a temporary workaround, consider restricting access to the Multi-Factor Authentication module to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-29041

GHSA-82J7-2H3J-HC7F

Affected Products

Liferay Dxp

References · 8

• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-82j7-2h3j-hc7f · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29041 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/14504 · Telegram Post
• https://t.me/cvenotify/14954 · Telegram Post