GitHub Advisoryadvisory · Maven

GHSA-vwj8-4grf-3r8v Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use

HIGH Published 2022-05-24 Modified 2025-06-27 Official page ↗
Aliases
CVE-2021-33322
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-613
Reviewed
2025-06-27

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 5.7.3 → fixed in 5.7.3 • Maven com.liferay.portal:release.dxp.bom: >= 7.0.0, < 7.0.10.fp96 → fixed in 7.0.10.fp96 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp18 → fixed in 7.1.10.fp18 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp5 → fixed in 7.2.10.fp5

Description

In implementation for the portal services before 5.7.3 in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2021-33322 In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password… vulnerability

References