CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not…

published August 3, 2021

CVSS
—
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01202 · 68.0th percentile
Published
2021-08-03T18:29Z
EPSS history
Timeline
  • 03 AUG 18:29Z
    In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not…
    cvelistv5