PT-2021-20102 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33321

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 6.2.3 through 7.3.2 Liferay DXP versions prior to 7.3

Description The issue is related to an insecure default configuration that allows remote attackers to enumerate user email addresses via the forgot password functionality. The configuration property login.secure.forgot.password should be set to true by default to prevent this.

Recommendations For Liferay Portal versions 6.2.3 through 7.3.2, set the portal.property login.secure.forgot.password to true. For Liferay DXP versions prior to 7.3, set the portal.property login.secure.forgot.password to true.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-33321

GHSA-JFCH-M2X3-2V66

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33321 · Vendor Advisory
• https://help.liferay.com/hc/en-us/articles/360050785632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33321 · Security Note
• https://osv.dev/vulnerability/GHSA-jfch-m2x3-2v66 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/06df28c5ad618afed967fa485418e6cc29c70f38 · Note
• https://github.com/liferay/liferay-portal/commit/37de1d78d9b1c4a473e3233a6ea146c741075e18 · Note
• https://t.me/cvenotify/18557 · Telegram Post