CVEvulnerability

CVE-2021-29040

5.3 MEDIUM Published 2021-05-16 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2021-05-16
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-209

Description

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

Affected configurations

• liferay digital experience platform (< 7.0) • liferay digital experience platform 7.0 • liferay digital experience platform 7.1 • liferay digital experience platform 7.2 • liferay liferay portal (<= 7.3.4)

Related

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References