In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before…
Priority LOW 35CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
Why it matters now
EPSS 0.01202 68th percentileScored 2026-11-07
Fix Fixed com.liferay.portal:com.liferay.portal.impl (Maven): 5.7.3com.liferay.portal:release.dxp.bom (Maven): 7.0.10.fp96, 7.1.10.fp18, 7.2.10.fp5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.liferay.portal:com.liferay.portal.impl (Maven) | before 5.7.3 | 5.7.3 | Patch available | GHSA-vwj8-4grf-3r8v |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.0.0 to before 7.0.10.fp96 | 7.0.10.fp96 | Patch available | GHSA-vwj8-4grf-3r8v |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.1.0 to before 7.1.10.fp18 | 7.1.10.fp18 | Patch available | GHSA-vwj8-4grf-3r8v |
| — | com.liferay.portal:release.dxp.bom (Maven) | 7.2.0 to before 7.2.10.fp5 | 7.2.10.fp5 | Patch available | GHSA-vwj8-4grf-3r8v |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.liferay.portal:com.liferay.portal.impl (Maven) Vendor— Affected before 5.7.3 Fixed in 5.7.3 Patch available GHSA-vwj8-4grf-3r8v
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.0.0 to before 7.0.10.fp96 Fixed in 7.0.10.fp96 Patch available GHSA-vwj8-4grf-3r8v
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.0 to before 7.1.10.fp18 Fixed in 7.1.10.fp18 Patch available GHSA-vwj8-4grf-3r8v
- com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp5 Fixed in 7.2.10.fp5 Patch available GHSA-vwj8-4grf-3r8v
CPE configurations NVD · 90
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* | 7.0 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* | 7.0 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* | 7.0 fix_pack_24 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* | 7.0 fix_pack_25 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* | 7.0 fix_pack_26 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* | 7.0 fix_pack_27 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* | 7.0 fix_pack_28 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* | 7.0 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* | 7.0 fix_pack_30 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* Versions 7.0 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
Show 80 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* | 7.0 fix_pack_33 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* | 7.0 fix_pack_35 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* | 7.0 fix_pack_36 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* | 7.0 fix_pack_39 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* | 7.0 fix_pack_40 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* | 7.0 fix_pack_41 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* | 7.0 fix_pack_42 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* | 7.0 fix_pack_43 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* | 7.0 fix_pack_44 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* | 7.0 fix_pack_45 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* | 7.0 fix_pack_46 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* | 7.0 fix_pack_47 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* | 7.0 fix_pack_48 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* | 7.0 fix_pack_49 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* | 7.0 fix_pack_50 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* | 7.0 fix_pack_51 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* | 7.0 fix_pack_52 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* | 7.0 fix_pack_53 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* | 7.0 fix_pack_54 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* | 7.0 fix_pack_56 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* | 7.0 fix_pack_57 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* | 7.0 fix_pack_58 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* | 7.0 fix_pack_59 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* | 7.0 fix_pack_60 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* | 7.0 fix_pack_61 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* | 7.0 fix_pack_64 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* | 7.0 fix_pack_65 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* | 7.0 fix_pack_66 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* | 7.0 fix_pack_67 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* | 7.0 fix_pack_68 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* | 7.0 fix_pack_69 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* | 7.0 fix_pack_70 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* | 7.0 fix_pack_71 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* | 7.0 fix_pack_72 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* | 7.0 fix_pack_73 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* | 7.0 fix_pack_75 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* | 7.0 fix_pack_76 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* | 7.0 fix_pack_78 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* | 7.0 fix_pack_79 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* | 7.0 fix_pack_80 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* | 7.0 fix_pack_81 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* | 7.0 fix_pack_82 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* | 7.0 fix_pack_83 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* | 7.0 fix_pack_84 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* | 7.0 fix_pack_85 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* | 7.0 fix_pack_86 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* | 7.0 fix_pack_87 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* | 7.0 fix_pack_88 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* | 7.0 fix_pack_89 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* | 7.0 fix_pack_90 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* | 7.0 fix_pack_91 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* | 7.0 fix_pack_92 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* | 7.0 fix_pack_93 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* | 7.0 fix_pack_94 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* | 7.0 fix_pack_95 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* | 7.1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* | 7.1 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* | 7.1 fix_pack_10 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* | 7.1 fix_pack_11 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* | 7.1 fix_pack_12 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* | 7.1 fix_pack_13 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* | 7.1 fix_pack_14 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* | 7.1 fix_pack_15 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* | 7.1 fix_pack_16 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* | 7.1 fix_pack_17 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* | 7.1 fix_pack_18 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* | 7.1 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* | 7.1 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* | 7.1 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* | 7.1 fix_pack_5 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* | 7.1 fix_pack_6 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* | 7.1 fix_pack_7 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* | 7.1 fix_pack_8 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* | 7.1 fix_pack_9 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* | 7.2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* | 7.2 fix_pack_1 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* | 7.2 fix_pack_2 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* | 7.2 fix_pack_3 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* | 7.2 fix_pack_4 | Vulnerable | Liferay |
| cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* | before 7.3.1 | Vulnerable | Liferay |
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* Versions 7.0 fix_pack_83 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* Versions 7.0 fix_pack_84 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* Versions 7.0 fix_pack_85 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* Versions 7.0 fix_pack_86 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* Versions 7.0 fix_pack_87 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* Versions 7.0 fix_pack_88 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* Versions 7.0 fix_pack_89 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_90:*:*:*:*:*:* Versions 7.0 fix_pack_90 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_91:*:*:*:*:*:* Versions 7.0 fix_pack_91 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_92:*:*:*:*:*:* Versions 7.0 fix_pack_92 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* Versions 7.0 fix_pack_93 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* Versions 7.0 fix_pack_94 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_95:*:*:*:*:*:* Versions 7.0 fix_pack_95 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* Versions 7.1 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* Versions 7.1 fix_pack_10 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* Versions 7.1 fix_pack_11 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* Versions 7.1 fix_pack_12 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* Versions 7.1 fix_pack_13 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* Versions 7.1 fix_pack_14 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* Versions 7.1 fix_pack_15 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* Versions 7.1 fix_pack_16 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:* Versions 7.1 fix_pack_17 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* Versions 7.1 fix_pack_18 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* Versions 7.1 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* Versions 7.1 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* Versions 7.1 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* Versions 7.1 fix_pack_5 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* Versions 7.1 fix_pack_6 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* Versions 7.1 fix_pack_7 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* Versions 7.1 fix_pack_8 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* Versions 7.1 fix_pack_9 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
- cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions before 7.3.1 Vulnerable ·Liferay
Remediation
- Fix · GHSA-vwj8-4grf-3r8v com.liferay.portal:com.liferay.portal.impl (Maven) Fixed in 5.7.3 Advisory →
- Fix · GHSA-vwj8-4grf-3r8v com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.0.10.fp96 Advisory →
- Fix · GHSA-vwj8-4grf-3r8v com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.1.10.fp18 Advisory →
- Fix · GHSA-vwj8-4grf-3r8v com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33322
- 2026-10-03 Alias added: GHSA-vwj8-4grf-3r8v
References
Advisory 2
Other 5
- https://github.com/liferay/liferay-portal/commit/8f072ee8527a1dd5c0ffa91c4a78641d0e666b95
- https://github.com/liferay/liferay-portal/commit/9fe453b34f58286a504d995be8ba50499adcf1b7
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-16981
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33322-password-change-does-not-invalidate-password-reset-tokens?p_r_p_assetEntryId=121610648&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121610648%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
More Liferay Digital Experience Platform vulnerabilities
- TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
- TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
- TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
- TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
- TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
Sources
- CVE-2021-33322 · CVE Program
- CVE-2021-33322 · NVD
- FIRST EPSS
- GHSA-vwj8-4grf-3r8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences