CVE-2021-29038

liferay digital experience platform, liferay portal

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-29038

Katalog CVE

CVSS 6.3 · Medium EPSS 0,28%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada liferay digital experience platform, liferay portal. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder answers.

Rincian

Terbit di NVD
20 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
EPSS (30 hari)
0,28% peluang dieksploitasi; lebih tinggi dari 19,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
liferay digital experience platform Semua versi sebelum 7.2
liferay digital experience platform Versi 7.2
liferay digital experience platform Versi 7.2 fix_pack_1
liferay digital experience platform Versi 7.2 fix_pack_10
liferay digital experience platform Versi 7.2 fix_pack_11
liferay digital experience platform Versi 7.2 fix_pack_12
liferay digital experience platform Versi 7.2 fix_pack_13
liferay digital experience platform Versi 7.2 fix_pack_14
liferay digital experience platform Versi 7.2 fix_pack_15
liferay digital experience platform Versi 7.2 fix_pack_16
liferay digital experience platform Versi 7.2 fix_pack_2
liferay digital experience platform Versi 7.2 fix_pack_3
liferay digital experience platform Versi 7.2 fix_pack_4
liferay digital experience platform Versi 7.2 fix_pack_5
liferay digital experience platform Versi 7.2 fix_pack_6
liferay digital experience platform Versi 7.2 fix_pack_7
liferay digital experience platform Versi 7.2 fix_pack_8
liferay digital experience platform Versi 7.2 fix_pack_9
liferay digital experience platform Versi 7.3
liferay liferay portal Semua versi hingga 7.2.1
liferay liferay portal Versi 7.3.0 hingga sebelum 7.3.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.