CVE-2021-38266

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan pada liferay portal, liferay digital experience platform. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.

Rincian

Terbit di NVD

2 Maret 2022

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 113 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://issues.liferay.com/browse/LPE-17191 issue tracking · advisory vendor
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-202... advisory vendor