PT-2021-20106 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33325

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.2 and earlier Liferay DXP versions 7.0 before fix pack 93 Liferay DXP versions 7.1 before fix pack 19 Liferay DXP versions 7.2 before fix pack 7

Description The issue allows attackers with access to the database to obtain a user's password if workflow is enabled for user creation. This is because user's clear text passwords are stored in the database.

Recommendations For Liferay Portal versions 7.3.2 and earlier, update to a version where the issue is fixed. For Liferay DXP versions 7.0 before fix pack 93, apply fix pack 93 or later. For Liferay DXP versions 7.1 before fix pack 19, apply fix pack 19 or later. For Liferay DXP versions 7.2 before fix pack 7, apply fix pack 7 or later.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-33325

GHSA-6C88-GVXW-F5HG

Affected Products

Liferay Dxp

Liferay Portal

References · 7

• https://issues.liferay.com/browse/LPE-17042 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6c88-gvxw-f5hg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33325 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/19109 · Telegram Post