CVE-2021-33322 json
Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use
published 2021-08-03 5 y ago modified 2026-06-17 4 mo ago also GHSA-vwj8-4grf-3r8v , EUVD-2021-20031
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.
Patch / fix
- maven com.liferay.portal:com.liferay.portal.impl 5.7.3
- maven com.liferay.portal:release.dxp.bom 7.0.10.fp96, 7.1.10.fp18, 7.2.10.fp5
- liferay liferay_portal 7.3.1
Exploit prediction
1.20% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:com.liferay.portal.impl | <5.7.3 |
5.7.3 |
| maven | com.liferay.portal:release.dxp.bom | >=7.0.0, <7.0.10.fp96 >=7.1.0, <7.1.10.fp18 >=7.2.0, <7.2.10.fp5 |
7.0.10.fp96 7.1.10.fp18 7.2.10.fp5 |
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
issues.liferay.com
/browse/LPE-16981
patch, vendor-advisory
-
github.com
/liferay/liferay-portal/commit/8f072ee8527a1dd5c0ffa91c4a78641d0e666b95
web
-
github.com
/liferay/liferay-portal/commit/9fe453b34f58286a504d995be8ba50499adcf1b7
web
-
portal.liferay.dev
/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020
release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-33322
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-16981
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33322-password-change-does-not-
web
Sources
- CVE List CVE-2021-33322
- GitHub Advisory GHSA-vwj8-4grf-3r8v
- NVD CVE-2021-33322
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.