Skip to content
Log inStart free trial

GHSA-mwhf-6mjm-6w3h CVE-2021-29038

Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers

Medium Maven
Severity
6.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.28%
Chance of exploitation in the next 30 days. Higher than 21.00% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Fix
Available
5 packages have a fixed version

Description

In Liferay Impl before 5.18.4, Liferay Users Admin Web before 5.0.33, Liferay Login Web before 5.0.18, and Liferay Commerce Account Web before 3.0.7 from Liferay Portal (7.2.0 through 7.3.5), and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

Affected versions

Maven

PackageVulnerableFixed in
com.liferay.commerce:com.liferay.commerce.account.web
< 3.0.7
3.0.7
com.liferay.portal:portal-impl
< 5.18.4
5.18.4
com.liferay.portal:release.dxp.bom
< 7.2.10.fp17
7.2.10.fp17
com.liferay.portal:release.dxp.bom
>= 7.3.0, < 7.3.10.fp1
7.3.10.fp1
com.liferay:com.liferay.login.web
< 5.0.18
5.0.18
com.liferay:com.liferay.users.admin.web
< 5.0.33
5.0.33

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

com.liferay.commerce:com.liferay.commerce.account.web Maven → 3.0.7

maven
<dependency><groupId>com.liferay.commerce</groupId><artifactId>com.liferay.commerce.account.web</artifactId><version>3.0.7</version></dependency>
gradle
implementation("com.liferay.commerce:com.liferay.commerce.account.web:3.0.7")

com.liferay.portal:portal-impl Maven → 5.18.4

maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>portal-impl</artifactId><version>5.18.4</version></dependency>
gradle
implementation("com.liferay.portal:portal-impl:5.18.4")

com.liferay.portal:release.dxp.bom Maven → 7.2.10.fp17

maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>release.dxp.bom</artifactId><version>7.2.10.fp17</version></dependency>
gradle
implementation("com.liferay.portal:release.dxp.bom:7.2.10.fp17")

com.liferay:com.liferay.login.web Maven → 5.0.18

maven
<dependency><groupId>com.liferay</groupId><artifactId>com.liferay.login.web</artifactId><version>5.0.18</version></dependency>
gradle
implementation("com.liferay:com.liferay.login.web:5.0.18")

com.liferay:com.liferay.users.admin.web Maven → 5.0.33

maven
<dependency><groupId>com.liferay</groupId><artifactId>com.liferay.users.admin.web</artifactId><version>5.0.33</version></dependency>
gradle
implementation("com.liferay:com.liferay.users.admin.web:5.0.33")

Severity breakdown

CVSS 3.1 6.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Weakness

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

How to prevent it
  • Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
  • Architecture and Design: Do not use standard weak security questions and use several security questions.
  • Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
  • Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
  • Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
  • Architecture and Design: Assign a new temporary password rather than revealing the original password.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-66x6-8jgv-qpfh
Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting
Medium Also affects com.liferay.portal:release.dxp.bom
GHSA-rcc7-jx7p-hrv4
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
Medium Also affects com.liferay.portal:release.dxp.bom
GHSA-m5c7-5gv3-hcpf
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
Medium Also affects com.liferay.portal:release.dxp.bom
GHSA-222w-xmc5-jhp3
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
Medium Also affects com.liferay.portal:release.dxp.bom
GHSA-cg99-m88x-422c
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
Medium Also affects com.liferay:com.liferay.users.admin.web
GHSA-c6g5-g6r7-q4j6
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
Medium Also affects com.liferay.portal:release.dxp.bom
GHSA-6v93-frf9-2rp8
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery
High Also affects com.liferay.portal:release.dxp.bom
GHSA-qhp6-vp7c-g7xp
Liferay Cross-site Scripting vulnerability
Medium Also affects com.liferay.portal:release.dxp.bom
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor