Read the docs
TI-2021-15898 Aliases CVE-2021-38266GHSA-jp3m-vh3g-6ggp

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.

Why it matters now

EPSS 0.01742 77th percentileScored 2026-11-07
Fix Fixed com.liferay:com.liferay.portal.security.ldap.impl (Maven): 2.0.19com.liferay.portal:release.dxp.bom (Maven): 7.3.0-ga1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.liferay:com.liferay.portal.security.ldap.impl (Maven)before 2.0.192.0.19Patch availableGHSA-jp3m-vh3g-6ggp
—com.liferay.portal:release.dxp.bom (Maven)before 7.3.0-ga17.3.0-ga1Patch availableGHSA-jp3m-vh3g-6ggp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.liferay:com.liferay.portal.security.ldap.impl (Maven) Vendor— Affected before 2.0.19 Fixed in 2.0.19 Patch available GHSA-jp3m-vh3g-6ggp
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected before 7.3.0-ga1 Fixed in 7.3.0-ga1 Patch available GHSA-jp3m-vh3g-6ggp

CPE configurations NVD · 113

CPEVersionsRoleVendor
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*up to 7.2.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:*7.0VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_1:*:*:*:*:*:*7.0 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_10:*:*:*:*:*:*7.0 fix_pack_10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_11:*:*:*:*:*:*7.0 fix_pack_11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_12:*:*:*:*:*:*7.0 fix_pack_12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:*7.0 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:*7.0 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_15:*:*:*:*:*:*7.0 fix_pack_15VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_16:*:*:*:*:*:*7.0 fix_pack_16VulnerableLiferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:* Versions up to 7.2.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_1:*:*:*:*:*:* Versions 7.0 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_10:*:*:*:*:*:* Versions 7.0 fix_pack_10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_11:*:*:*:*:*:* Versions 7.0 fix_pack_11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_12:*:*:*:*:*:* Versions 7.0 fix_pack_12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_13:*:*:*:*:*:* Versions 7.0 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_14:*:*:*:*:*:* Versions 7.0 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_15:*:*:*:*:*:* Versions 7.0 fix_pack_15 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_16:*:*:*:*:*:* Versions 7.0 fix_pack_16 Vulnerable ·Liferay
Show 103 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_17:*:*:*:*:*:*7.0 fix_pack_17VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_18:*:*:*:*:*:*7.0 fix_pack_18VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_19:*:*:*:*:*:*7.0 fix_pack_19VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_2:*:*:*:*:*:*7.0 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_20:*:*:*:*:*:*7.0 fix_pack_20VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_21:*:*:*:*:*:*7.0 fix_pack_21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_22:*:*:*:*:*:*7.0 fix_pack_22VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_23:*:*:*:*:*:*7.0 fix_pack_23VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:*7.0 fix_pack_24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:*7.0 fix_pack_25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:*7.0 fix_pack_26VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:*7.0 fix_pack_27VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:*7.0 fix_pack_28VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_29:*:*:*:*:*:*7.0 fix_pack_29VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:*7.0 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:*7.0 fix_pack_30VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_31:*:*:*:*:*:*7.0 fix_pack_31VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_32:*:*:*:*:*:*7.0 fix_pack_32VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:*7.0 fix_pack_33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_34:*:*:*:*:*:*7.0 fix_pack_34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:*7.0 fix_pack_35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:*7.0 fix_pack_36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_37:*:*:*:*:*:*7.0 fix_pack_37VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_38:*:*:*:*:*:*7.0 fix_pack_38VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:*7.0 fix_pack_39VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_4:*:*:*:*:*:*7.0 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:*7.0 fix_pack_40VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:*7.0 fix_pack_41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:*7.0 fix_pack_42VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:*7.0 fix_pack_43VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:*7.0 fix_pack_44VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:*7.0 fix_pack_45VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:*7.0 fix_pack_46VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:*7.0 fix_pack_47VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:*7.0 fix_pack_48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:*7.0 fix_pack_49VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_5:*:*:*:*:*:*7.0 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:*7.0 fix_pack_50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:*7.0 fix_pack_51VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:*7.0 fix_pack_52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:*7.0 fix_pack_53VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:*7.0 fix_pack_54VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_55:*:*:*:*:*:*7.0 fix_pack_55VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:*7.0 fix_pack_56VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:*7.0 fix_pack_57VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:*7.0 fix_pack_58VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:*7.0 fix_pack_59VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_6:*:*:*:*:*:*7.0 fix_pack_6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:*7.0 fix_pack_60VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:*7.0 fix_pack_61VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_62:*:*:*:*:*:*7.0 fix_pack_62VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_63:*:*:*:*:*:*7.0 fix_pack_63VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:*7.0 fix_pack_64VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:*7.0 fix_pack_65VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:*7.0 fix_pack_66VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:*7.0 fix_pack_67VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:*7.0 fix_pack_68VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:*7.0 fix_pack_69VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_7:*:*:*:*:*:*7.0 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:*7.0 fix_pack_70VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:*7.0 fix_pack_71VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:*7.0 fix_pack_72VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:*7.0 fix_pack_73VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_74:*:*:*:*:*:*7.0 fix_pack_74VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:*7.0 fix_pack_75VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:*7.0 fix_pack_76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_77:*:*:*:*:*:*7.0 fix_pack_77VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:*7.0 fix_pack_78VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:*7.0 fix_pack_79VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_8:*:*:*:*:*:*7.0 fix_pack_8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:*7.0 fix_pack_80VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:*7.0 fix_pack_81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:*7.0 fix_pack_82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:*7.0 fix_pack_83VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:*7.0 fix_pack_84VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:*7.0 fix_pack_85VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:*7.0 fix_pack_86VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:*7.0 fix_pack_87VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:*7.0 fix_pack_88VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:*7.0 fix_pack_89VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_9:*:*:*:*:*:*7.0 fix_pack_9VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*7.1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*7.1 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*7.1 fix_pack_10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*7.1 fix_pack_11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*7.1 fix_pack_12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*7.1 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*7.1 fix_pack_14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*7.1 fix_pack_15VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*7.1 fix_pack_16VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*7.1 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*7.1 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*7.1 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*7.1 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*7.1 fix_pack_6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*7.1 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*7.1 fix_pack_8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*7.1 fix_pack_9VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*7.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*7.2 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*7.2 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*7.2 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*7.2 fix_pack_4VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_17:*:*:*:*:*:* Versions 7.0 fix_pack_17 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_18:*:*:*:*:*:* Versions 7.0 fix_pack_18 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_19:*:*:*:*:*:* Versions 7.0 fix_pack_19 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_2:*:*:*:*:*:* Versions 7.0 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_20:*:*:*:*:*:* Versions 7.0 fix_pack_20 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_21:*:*:*:*:*:* Versions 7.0 fix_pack_21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_22:*:*:*:*:*:* Versions 7.0 fix_pack_22 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_23:*:*:*:*:*:* Versions 7.0 fix_pack_23 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_24:*:*:*:*:*:* Versions 7.0 fix_pack_24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_25:*:*:*:*:*:* Versions 7.0 fix_pack_25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_26:*:*:*:*:*:* Versions 7.0 fix_pack_26 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_27:*:*:*:*:*:* Versions 7.0 fix_pack_27 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_28:*:*:*:*:*:* Versions 7.0 fix_pack_28 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_29:*:*:*:*:*:* Versions 7.0 fix_pack_29 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_3:*:*:*:*:*:* Versions 7.0 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_30:*:*:*:*:*:* Versions 7.0 fix_pack_30 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_31:*:*:*:*:*:* Versions 7.0 fix_pack_31 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_32:*:*:*:*:*:* Versions 7.0 fix_pack_32 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_33:*:*:*:*:*:* Versions 7.0 fix_pack_33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_34:*:*:*:*:*:* Versions 7.0 fix_pack_34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_35:*:*:*:*:*:* Versions 7.0 fix_pack_35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_36:*:*:*:*:*:* Versions 7.0 fix_pack_36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_37:*:*:*:*:*:* Versions 7.0 fix_pack_37 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_38:*:*:*:*:*:* Versions 7.0 fix_pack_38 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_39:*:*:*:*:*:* Versions 7.0 fix_pack_39 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_4:*:*:*:*:*:* Versions 7.0 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_40:*:*:*:*:*:* Versions 7.0 fix_pack_40 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_41:*:*:*:*:*:* Versions 7.0 fix_pack_41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_42:*:*:*:*:*:* Versions 7.0 fix_pack_42 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_43:*:*:*:*:*:* Versions 7.0 fix_pack_43 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_44:*:*:*:*:*:* Versions 7.0 fix_pack_44 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_45:*:*:*:*:*:* Versions 7.0 fix_pack_45 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_46:*:*:*:*:*:* Versions 7.0 fix_pack_46 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_47:*:*:*:*:*:* Versions 7.0 fix_pack_47 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_48:*:*:*:*:*:* Versions 7.0 fix_pack_48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_49:*:*:*:*:*:* Versions 7.0 fix_pack_49 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_5:*:*:*:*:*:* Versions 7.0 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_50:*:*:*:*:*:* Versions 7.0 fix_pack_50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_51:*:*:*:*:*:* Versions 7.0 fix_pack_51 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_52:*:*:*:*:*:* Versions 7.0 fix_pack_52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_53:*:*:*:*:*:* Versions 7.0 fix_pack_53 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_54:*:*:*:*:*:* Versions 7.0 fix_pack_54 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_55:*:*:*:*:*:* Versions 7.0 fix_pack_55 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_56:*:*:*:*:*:* Versions 7.0 fix_pack_56 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_57:*:*:*:*:*:* Versions 7.0 fix_pack_57 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_58:*:*:*:*:*:* Versions 7.0 fix_pack_58 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_59:*:*:*:*:*:* Versions 7.0 fix_pack_59 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_6:*:*:*:*:*:* Versions 7.0 fix_pack_6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_60:*:*:*:*:*:* Versions 7.0 fix_pack_60 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_61:*:*:*:*:*:* Versions 7.0 fix_pack_61 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_62:*:*:*:*:*:* Versions 7.0 fix_pack_62 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_63:*:*:*:*:*:* Versions 7.0 fix_pack_63 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_64:*:*:*:*:*:* Versions 7.0 fix_pack_64 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_65:*:*:*:*:*:* Versions 7.0 fix_pack_65 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_66:*:*:*:*:*:* Versions 7.0 fix_pack_66 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_67:*:*:*:*:*:* Versions 7.0 fix_pack_67 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_68:*:*:*:*:*:* Versions 7.0 fix_pack_68 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_69:*:*:*:*:*:* Versions 7.0 fix_pack_69 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_7:*:*:*:*:*:* Versions 7.0 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_70:*:*:*:*:*:* Versions 7.0 fix_pack_70 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_71:*:*:*:*:*:* Versions 7.0 fix_pack_71 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_72:*:*:*:*:*:* Versions 7.0 fix_pack_72 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_73:*:*:*:*:*:* Versions 7.0 fix_pack_73 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_74:*:*:*:*:*:* Versions 7.0 fix_pack_74 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_75:*:*:*:*:*:* Versions 7.0 fix_pack_75 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_76:*:*:*:*:*:* Versions 7.0 fix_pack_76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_77:*:*:*:*:*:* Versions 7.0 fix_pack_77 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_78:*:*:*:*:*:* Versions 7.0 fix_pack_78 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_79:*:*:*:*:*:* Versions 7.0 fix_pack_79 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_8:*:*:*:*:*:* Versions 7.0 fix_pack_8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_80:*:*:*:*:*:* Versions 7.0 fix_pack_80 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_81:*:*:*:*:*:* Versions 7.0 fix_pack_81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_82:*:*:*:*:*:* Versions 7.0 fix_pack_82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_83:*:*:*:*:*:* Versions 7.0 fix_pack_83 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_84:*:*:*:*:*:* Versions 7.0 fix_pack_84 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_85:*:*:*:*:*:* Versions 7.0 fix_pack_85 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_86:*:*:*:*:*:* Versions 7.0 fix_pack_86 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_87:*:*:*:*:*:* Versions 7.0 fix_pack_87 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_88:*:*:*:*:*:* Versions 7.0 fix_pack_88 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_89:*:*:*:*:*:* Versions 7.0 fix_pack_89 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_9:*:*:*:*:*:* Versions 7.0 fix_pack_9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:* Versions 7.1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:* Versions 7.1 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:* Versions 7.1 fix_pack_10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:* Versions 7.1 fix_pack_11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:* Versions 7.1 fix_pack_12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:* Versions 7.1 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:* Versions 7.1 fix_pack_14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:* Versions 7.1 fix_pack_15 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:* Versions 7.1 fix_pack_16 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:* Versions 7.1 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:* Versions 7.1 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:* Versions 7.1 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:* Versions 7.1 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:* Versions 7.1 fix_pack_6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:* Versions 7.1 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:* Versions 7.1 fix_pack_8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:* Versions 7.1 fix_pack_9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-jp3m-vh3g-6ggp com.liferay:com.liferay.portal.security.ldap.impl (Maven) Fixed in 2.0.19 Advisory →
  • Fix · GHSA-jp3m-vh3g-6ggp com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.0-ga1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38266
  2. 2026-10-03 Alias added: GHSA-jp3m-vh3g-6ggp

References

Advisory 3

Other 3

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences