CVE-2021-33321 json
Liferay Portal and Liferay DXP insecure default configuration
published 5y ago modified 4mo ago also GHSA-jfch-m2x3-2v66 , EUVD-2021-20030
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.
Patch / fix
- maven com.liferay.portal:com.liferay.portal.impl 5.11.0
- maven com.liferay.portal:release.portal.bom 7.3.3
- liferay dxp 7.3
- liferay liferay_portal 7.3.3
Is CVE-2021-33321 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.43% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:com.liferay.portal.impl | <5.11.0 |
5.11.0 |
| maven | com.liferay.portal:release.portal.bom | <7.3.3 |
7.3.3 |
Classification
- Weakness
-
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
-
github.com
/liferay/liferay-portal/commit/06df28c5ad618afed967fa485418e6cc29c70f38
web
-
github.com
/liferay/liferay-portal/commit/37de1d78d9b1c4a473e3233a6ea146c741075e18
web
-
portal.liferay.dev
/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055
web, release-notes, vendor-advisory
-
help.liferay.com
/hc/en-us/articles/360050785632
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-33321
advisory
-
github.com
/liferay/liferay-portal
package
Sources
- CVE List CVE-2021-33321
- GitHub Advisory GHSA-jfch-m2x3-2v66
- NVD CVE-2021-33321
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.