Vulnerability Details : CVE-2021-33321
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
Products affected by CVE-2021-33321
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
- cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*
Threat overview for CVE-2021-33321
Top countries where our scanners detected CVE-2021-33321
Top open port discovered on systems with this issue
80
IPs affected by CVE-2021-33321 268
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2021-33321!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2021-33321
0.37%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-33321
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-33321
-
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-33321
-
https://help.liferay.com/hc/en-us/articles/360050785632
How to prevent user enumeration attacks through the Forgot Password functionality – Liferay Help CenterVendor Advisory
-
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055
CVE-2021-33321 Insecure default configuration allows for user enumeration using forgot passwordRelease Notes;Vendor Advisory
Jump to