PT-2021-20103 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2025-05-13 · CVE-2021-33322

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 and earlier Liferay DXP versions 7.0 before fix pack 96 Liferay DXP versions 7.1 before fix pack 18 Liferay DXP versions 7.2 before fix pack 5

Description The issue allows remote attackers to change a user's password via an old password reset token because the tokens are not invalidated after a user changes their password.

Recommendations For Liferay Portal versions 7.3.0 and earlier, update to a version later than 7.3.0. For Liferay DXP versions 7.0 before fix pack 96, apply fix pack 96 or later. For Liferay DXP versions 7.1 before fix pack 18, apply fix pack 18 or later. For Liferay DXP versions 7.2 before fix pack 5, apply fix pack 5 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-33322

GHSA-VWJ8-4GRF-3R8V

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://issues.liferay.com/browse/LPE-16981 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vwj8-4grf-3r8v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33322 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33322 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/8f072ee8527a1dd5c0ffa91c4a78641d0e666b95 · Note
• https://github.com/liferay/liferay-portal/commit/9fe453b34f58286a504d995be8ba50499adcf1b7 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33322-password-change-does-not-invalidate-password-reset-tokens?p_r_p_assetEntryId=121610648&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610648%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/122022 · Telegram Post
• https://t.me/cvenotify/19123 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-16981 · Note