CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-33321
https://notcve.org/view.php?id=CVE-2021-33321
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true. Una configuración no segura predeterminada en Liferay Portal versiones 6.2.3 hasta 7.3.2, y Liferay DXP versiones anteriores a 7.3, permite a atacantes remotos enumerar la dirección de correo electrónico del usuario por medio de la funcionalidad forgot password. La función portal.property login.secure.forgot.password debería estar por defecto en true • https://help.liferay.com/hc/en-us/articles/360050785632 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748055 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 4.3EPSS: 0%CPEs: 91EXPL: 0CVE-2021-33320
https://notcve.org/view.php?id=CVE-2021-33320
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails El módulo Flags en Liferay Portal versiones 7.3.1 y anteriores, y Liferay DXP versiones 7.0 anteriores a fix pack 96, versiones 7.1 anteriores a fix pack 20, y versiones 7.2 anteriores a fix pack 5, no limita la velocidad a la que el contenido puede ser marcado como inapropiado, que permite a usuarios autenticado remoto hacer spam al administrador del sitio con correos electrónicos • https://issues.liferay.com/browse/LPE-17007 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29052
https://notcve.org/view.php?id=CVE-2021-29052
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls. El módulo Data Engine en Liferay Portal versiones 7.3.0 hasta 7.3.5 y Liferay DXP versiones 7.3 anteriores a fixpack 1 no comprueba los permisos en DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, que permite a los usuarios autenticados remotos visualizar estructuras DDMS por medio de llamadas a la API GET • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743159 • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2021-29048
https://notcve.org/view.php?id=CVE-2021-29048
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en la página de administración page del módulo Layout en Liferay Portal versiones 7.3.4, 7.3.5 y Liferay DXP versiones 7.2 anteriores a fixpack 11 y versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del parámetro _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743601 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 33EXPL: 0CVE-2021-29051
https://notcve.org/view.php?id=CVE-2021-29051
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en la aplicación Asset Publisher del módulo Asset en Liferay Portal versiones 7.2.1 hasta 7.3.5, y Liferay DXP versiones 7.1 anteriores a fixpack 21, versiones 7.2 anteriores a fixpack 10 y versiones 7.3 anteriores a fixpack 1, permite a atacantes remotos inyectar un script web o HTML arbitrario por medio del parámetro _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743580 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •