PT-2022-10706 · Liferay · Liferay Portal+1

Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38266

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.1 and earlier Liferay DXP versions 7.0 through 7.0 before fix pack 90 Liferay DXP versions 7.1 through 7.1 before fix pack 17 Liferay DXP versions 7.2 through 7.2 before fix pack 5

Description The issue concerns the incorrect import of users from LDAP, allowing remote attackers to prevent legitimate users from authenticating by attempting to sign in as a user that exists in LDAP. This can be achieved by attempting to sign in as a user that exists in LDAP.

Recommendations For Liferay Portal versions 7.2.1 and earlier, update to a version that correctly imports users from LDAP. For Liferay DXP versions 7.0 through 7.0 before fix pack 90, apply fix pack 90 or later. For Liferay DXP versions 7.1 through 7.1 before fix pack 17, apply fix pack 17 or later. For Liferay DXP versions 7.2 through 7.2 before fix pack 5, apply fix pack 5 or later.

Fix

Related Identifiers

BIT-LIFERAY-2021-38266

CVE-2021-38266

GHSA-JP3M-VH3G-6GGP

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://issues.liferay.com/browse/LPE-17191 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38266 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp3m-vh3g-6ggp · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38266 · Security Note
• https://osv.dev/vulnerability/BIT-liferay-2021-38266 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38266 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736 · Note
• https://t.me/cvenotify/27680 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611673%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note