CVE-2021-33322

EPSS 1.2%
Veröffentlicht 03.08.2021 19:15:08
Zuletzt bearbeitet 13.05.2025 18:17:51
Erkennungen
Login

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 90 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version 7.0 Update -

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_24

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_25

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_26

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_27

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_28

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_30

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_33

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_35

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_36

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_39

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_40

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_41

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_42

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_43

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_44

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_45

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_46

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_47

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_48

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_49

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_50

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_51

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_52

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_53

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_54

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_56

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_57

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_58

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_59

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_60

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_61

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_64

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_65

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_66

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_67

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_68

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_69

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_70

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_71

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_72

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_73

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_75

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_76

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_78

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_79

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_80

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_81

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_82

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_83

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_84

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_85

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_86

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_87

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_88

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_89

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_90

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_91

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_92

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_93

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_94

Liferay ≫ Digital Experience Platform Version 7.0 Update fix_pack_95

Liferay ≫ Digital Experience Platform Version 7.1 Update -

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_17

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_18

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Liferay Portal Version < 7.3.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.2%	0.642

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://issues.liferay.com/browse/LPE-16981

Patch

Vendor Advisory

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-33322

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-33322

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-33322

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-33322