Vulnerabilities > CVE-2021-38266 - Unspecified vulnerability in Liferay Portal

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
liferay
NVD
Published: 2022-03-02
Updated: 2024-11-21

Summary

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.

Vulnerable Configurations

Part Description Count
Application
Liferay
202

References