GitHub Advisoryadvisory · Maven

GHSA-xx2h-2hf5-v7vv Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password

MEDIUM Published 2022-05-24 Modified 2025-05-28 Official page ↗
Aliases
CVE-2021-29043
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-522
Reviewed
2025-05-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.0.0, < 7.3.6 → fixed in 7.3.6 • Maven com.liferay.portal:release.dxp.bom: < 7.0.10.fp97 → fixed in 7.0.10.fp97 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp21 → fixed in 7.1.10.fp21 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp10 → fixed in 7.2.10.fp10 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.fp1 → fixed in 7.3.10.fp1

Description

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.

Related

Alias · CVE (1)

  • CVE-2021-29043 The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References