CVE-2021-33325 — Cleartext Storage of Sensitive Info in Portal

CWE-312 — Cleartext Storage of Sensitive Info4 documents4 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 68.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay Digital Experience Platform
Timeline
PublishedAug 3
Latest updateMay 24

Description

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the database to obtain a user's password.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: issues.liferay.com ↗Patch: issues.liferay.com ↗

🔴Vulnerability Details

3
GHSA
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext↗2022-05-24
▶
OSV
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext↗2022-05-24
▶
CVEList
CVE-2021-33325: The Portal Workflow module in Liferay Portal 7↗2021-08-03
▶
CVE-2021-33325 — Cleartext Storage of Sensitive Info | cvebase