CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email addr...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

advisory help.liferay.com
advisory portal.liferay.dev