Vulnerabilities > CVE-2021-33322 - Insufficient Session Expiration vulnerability in Liferay DXP 7.0

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

liferay

CWE-613

NVD

Published: 2021-08-03

Updated: 2024-11-21

Summary

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

Vulnerable Configurations

Part	Description	Count
Application	Liferay Liferay DXP 7.0 Liferay DXP 7.2 Liferay DXP 7.1 Liferay Liferay Portal - Liferay Liferay Portal 1.7.5 Liferay Liferay Portal 1.8.0 Liferay Liferay Portal 1.9.0 Liferay Liferay Portal 1.9.1 Liferay Liferay Portal 1.9.5 Liferay Liferay Portal 2.0.0 Liferay Liferay Portal 2.0.3 Liferay Liferay Portal 2.1.0 Liferay Liferay Portal 2.1.1 Liferay Liferay Portal 2.2.0 Liferay Liferay Portal 2.2.1 Liferay Liferay Portal 2.2.5 Liferay Liferay Portal 3.0.0 Liferay Liferay Portal 3.1.0 Liferay Liferay Portal 3.2.0 Liferay Liferay Portal 3.5.0 Liferay Liferay Portal 3.6.0 Liferay Liferay Portal 3.6.1 Liferay Liferay Portal 4.0.0 Liferay Liferay Portal 4.1.0 Liferay Liferay Portal 4.1.1 Liferay Liferay Portal 4.1.2 Liferay Liferay Portal 4.1.3 Liferay Liferay Portal 4.2.0 Liferay Liferay Portal 4.2.1 Liferay Liferay Portal 4.2.2 Liferay Liferay Portal 4.3.0 Liferay Liferay Portal 4.3.1 Liferay Liferay Portal 4.3.2 Liferay Liferay Portal 4.3.3 Liferay Liferay Portal 4.3.4 Liferay Liferay Portal 4.3.5 Liferay Liferay Portal 4.3.6 Liferay Liferay Portal 4.4.0 Liferay Liferay Portal 4.4.1 Liferay Liferay Portal 4.4.2 Liferay Liferay Portal 5.0.0 Liferay Liferay Portal 5.1.0 Liferay Liferay Portal 5.1.1 Liferay Liferay Portal 5.1.2 Liferay Liferay Portal 5.2 Liferay Liferay Portal 5.2.0 Liferay Liferay Portal 5.2.1 Liferay Liferay Portal 5.2.2 Liferay Liferay Portal 5.2.3 Liferay Liferay Portal 6.0 Liferay Liferay Portal 6.0.0 Liferay Liferay Portal 6.0.1 Liferay Liferay Portal 6.0.2 Liferay Liferay Portal 6.0.3 Liferay Liferay Portal 6.0.4 Liferay Liferay Portal 6.0.5 Liferay Liferay Portal 6.0.6 Liferay Liferay Portal 6.1 Liferay Liferay Portal 6.1.0 Liferay Liferay Portal 6.1.1 Liferay Liferay Portal 6.1.2 Liferay Liferay Portal 6.1.2_Ce_Ga3 Liferay Liferay Portal 6.1.X_Ee Liferay Liferay Portal 6.2 Liferay Liferay Portal 6.2.0 Liferay Liferay Portal 6.2.1 Liferay Liferay Portal 6.2.2 Liferay Liferay Portal 6.2.3 Liferay Liferay Portal 6.2.4 Liferay Liferay Portal 6.2.5 Liferay Liferay Portal 6.2.X_Ee Liferay Liferay Portal 7.0 Liferay Liferay Portal 7.0.0 Liferay Liferay Portal 7.0.1 Liferay Liferay Portal 7.0.2 Liferay Liferay Portal 7.0.3 Liferay Liferay Portal 7.0.3_Ga4 Liferay Liferay Portal 7.0.4 Liferay Liferay Portal 7.0.5 Liferay Liferay Portal 7.0.6 Liferay Liferay Portal 7.1 Liferay Liferay Portal 7.1.0 Liferay Liferay Portal 7.1.1 Liferay Liferay Portal 7.1.2 Liferay Liferay Portal 7.1.3 Liferay Liferay Portal 7.2 Liferay Liferay Portal 7.2.0 Liferay Liferay Portal 7.2.1 Liferay Liferay Portal 7.3 Liferay Liferay Portal 7.3.0	328

Common Weakness Enumeration (CWE)

CWE-613 - Insufficient Session Expiration

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References