Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

Published

2021-08-03T19:15:08.590

Last Modified

2024-11-21T06:08:41.063

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-640

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	liferay	dxp	< 7.3	Yes
Application	liferay	liferay_portal	< 7.3.3	Yes

References

https://help.liferay.com/hc/en-us/articles/360050785632 Vendor Advisory ([email protected])
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 Release Notes, Vendor Advisory ([email protected])
https://help.liferay.com/hc/en-us/articles/360050785632 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)