CVE-2021-33322 | BDVDB-2026-158010 Detail

Description#

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748020
https://issues.liferay.com/browse/LPE-16981

Exploit#

No public exploit known

History#

Version 12021-08-03Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.