PT-2021-20102
CVE-2021-33321
·
تاريخ النشر
2021-08-03
·
تاريخ التحديث
2022-05-24
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 6.2.3 through 7.3.2
Liferay DXP versions prior to 7.3
Description
The issue is related to an insecure default configuration that allows remote attackers to enumerate user email addresses via the forgot password functionality. The configuration property
login.secure.forgot.password should be set to true by default to prevent this.Recommendations
For Liferay Portal versions 6.2.3 through 7.3.2, set the
portal.property login.secure.forgot.password to true.
For Liferay DXP versions prior to 7.3, set the portal.property login.secure.forgot.password to true. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾