Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

Published

2021-08-03T19:15:08.623

Last Modified

2025-05-13T18:17:51.450

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-613

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.0	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.1	Yes
Application	liferay	digital_experience_platform	7.2	Yes
Application	liferay	digital_experience_platform	7.2	Yes
Application	liferay	digital_experience_platform	7.2	Yes
Application	liferay	digital_experience_platform	7.2	Yes
Application	liferay	digital_experience_platform	7.2	Yes
Application	liferay	liferay_portal	< 7.3.1	Yes

References

https://issues.liferay.com/browse/LPE-16981 Patch, Vendor Advisory ([email protected])
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 Release Notes, Vendor Advisory ([email protected])
https://issues.liferay.com/browse/LPE-16981 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)