First published: Tue Aug 03 2021(Updated: )
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Liferay DXP | <7.3 | |
Liferay Liferay Portal | >=6.2.3<7.3.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2021-33321.
The severity of CVE-2021-33321 is high with a CVSS score of 7.5.
The insecure default configuration allows remote attackers to enumerate user email addresses via the forgot password functionality.
The recommended configuration for the portal.property login.secure.forgot.password is to set it to true.
You can find more information about CVE-2021-33321 and its fix in the references provided: [Reference 1](https://help.liferay.com/hc/en-us/articles/360050785632) and [Reference 2](https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055).