CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via…

published August 3, 2021

CVSS
—
EPSS
1%
Percentile
72.9
In the wild
Unconfirmed
What it is

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01434 · 72.9th percentile
Published
2021-08-03T18:12Z
EPSS history
Timeline
  • 03 AUG 18:12Z
    Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via…
    cvelistv5