CVE-2021-33321: High severity liferay 7.4 ga vulnerability
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
Other sources
Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this insecure default configuration in Liferay Portal and Liferay DXP?
The vulnerability ID is CVE-2021-33321.
What is the severity of CVE-2021-33321?
The severity of CVE-2021-33321 is high with a CVSS score of 7.5.
How does the insecure default configuration in Liferay Portal and Liferay DXP allow remote attackers to exploit the vulnerability?
The insecure default configuration allows remote attackers to enumerate user email addresses via the forgot password functionality.
What is the recommended configuration for the portal.property login.secure.forgot.password?
The recommended configuration for the portal.property login.secure.forgot.password is to set it to true.
Where can I find more information about CVE-2021-33321 and its fix?
You can find more information about CVE-2021-33321 and its fix in the references provided: [Reference 1](https://help.liferay.com/hc/en-us/articles/360050785632) and [Reference 2](https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055).