GitHub Advisoryadvisory · Maven

GHSA-jfch-m2x3-2v66 Liferay Portal and Liferay DXP insecure default configuration

HIGH Published 2022-05-24 Modified 2025-06-27 Official page ↗
Aliases
CVE-2021-33321
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.portal.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-640
Reviewed
2025-06-27

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 5.11.0 → fixed in 5.11.0 • Maven com.liferay.portal:release.portal.bom: < 7.3.3 → fixed in 7.3.3

Description

Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

Related

Alias · CVE (1)

  • CVE-2021-33321 Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user… vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References