GHSA-vwj8-4grf-3r8v CVE-2021-33322
Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.20%
- Chance of exploitation in the next 30 days. Higher than 68.24% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
- Available
- 2 packages have a fixed version
Description
In implementation for the portal services before 5.7.3 in Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.liferay.portal:com.liferay.portal.impl | < 5.7.3 |
5.7.3 |
| com.liferay.portal:release.dxp.bom | >= 7.0.0, < 7.0.10.fp96 |
7.0.10.fp96 |
| com.liferay.portal:release.dxp.bom | >= 7.1.0, < 7.1.10.fp18 |
7.1.10.fp18 |
| com.liferay.portal:release.dxp.bom | >= 7.2.0, < 7.2.10.fp5 |
7.2.10.fp5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
com.liferay.portal:com.liferay.portal.impl Maven → 5.7.3
- maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>com.liferay.portal.impl</artifactId><version>5.7.3</version></dependency>- gradle
implementation("com.liferay.portal:com.liferay.portal.impl:5.7.3")
com.liferay.portal:release.dxp.bom Maven → 7.0.10.fp96
- maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>release.dxp.bom</artifactId><version>7.0.10.fp96</version></dependency>- gradle
implementation("com.liferay.portal:release.dxp.bom:7.0.10.fp96")
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-rx48-gqc2-4w47 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-pfwq-mr9g-gq6m Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-2hm7-r8f3-423h Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet | High | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-697h-3q6m-jwp4 Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability | Medium | Also affects com.liferay.portal:com.liferay.portal.impl |
| GHSA-95h4-8mqc-4mpf Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC | High | Also affects com.liferay.portal:com.liferay.portal.impl |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor