What is CVE-2021-33322?

CVE-2021-33322 is a high-severity vulnerability in Liferay Digital Experience Platform, classified under Insufficient Session Expiration. CVSS score: 7.5/10. Published 2021-08-03.

How severe is CVE-2021-33322?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Liferay Digital Experience Platform

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token.

EPSS: 0.012 (65.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Liferay Digital_experience_platform — versions 7.0, 7.1, 7.2
Liferay Liferay_portal
N/a — versions n/a

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

cve@mitre.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2021-33322?: CVE-2021-33322 is a high-severity vulnerability in Liferay Digital Experience Platform, classified under Insufficient Session Expiration. CVSS score: 7.5/10. Published 2021-08-03.
How severe is CVE-2021-33322?: High severity. CVSS v3 base score is 7.5 out of 10.