ByteOS Network

NVD Vulnerability Details :

CVE-2021-33321

Analyzed

Source-cve@mitre.org

Published At-03 Aug, 2021 | 19:15

Updated At-11 Aug, 2021 | 15:17

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

Liferay Inc.

>>dxp>>Versions before 7.3(exclusive)

cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*

Liferay Inc.

>>liferay_portal>>Versions from 6.2.3(inclusive) to 7.3.3(exclusive)

cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-640	Primary	nvd@nist.gov

CWE ID: CWE-640

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://help.liferay.com/hc/en-us/articles/360050785632	cve@mitre.org	Vendor Advisory
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055	cve@mitre.org	Release Notes Vendor Advisory

Hyperlink: https://help.liferay.com/hc/en-us/articles/360050785632

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055

Source: cve@mitre.org

Resource:

Release Notes

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History