~ / search / GHSA-87x7-pwrx-jch7

GHSA-87x7-pwrx-jch7

Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-29040

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay.portal:release.portal.bom < 7.3.5 7.3.5
Maven com.liferay.portal:release.dxp.bom < 7.0.10.fp97 7.0.10.fp97
Maven com.liferay.portal:release.dxp.bom >= 7.1.0, < 7.1.10.fp20 7.1.10.fp20
Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp10 7.2.10.fp10

Details

As written in the advisory (Markdown source, shown as plain text).

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

References

External links from the advisory. They lead to third-party sites.