PT-2021-18045 · Liferay · Liferay Portal+1

Published 2021-05-16 · Updated 2022-05-24 · CVE-2021-29047

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.4 through 7.3.5 Liferay DXP 7.3 before fix pack 1

Description: The SimpleCaptcha implementation does not invalidate CAPTCHA answers after use, allowing remote attackers to reuse the same CAPTCHA answer to perform actions protected by a CAPTCHA challenge.

Recommendations: For Liferay Portal versions 7.3.4 through 7.3.5, apply fix pack 1 to resolve the issue. For Liferay DXP 7.3 before fix pack 1, apply fix pack 1 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-29047

GHSA-9MXG-P873-6793

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9mxg-p873-6793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29047 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29047 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://web.archive.org/web/20210524180455/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743467 · Note
• https://t.me/cvenotify/14503 · Telegram Post