CVE-2021-33321

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 6.2.3 through 7.3.2 Liferay DXP versions prior to 7.3

Description The issue is related to an insecure default configuration that allows remote attackers to enumerate user email addresses via the forgot password functionality. The configuration property login.secure.forgot.password should be set to true by default to prevent this.

Recommendations For Liferay Portal versions 6.2.3 through 7.3.2, set the portal.property login.secure.forgot.password to true. For Liferay DXP versions prior to 7.3, set the portal.property login.secure.forgot.password to true.