GHSA-jp3m-vh3g-6ggp

Liferay Portal and Liferay DXP fails to properly import users from LDAP

Source: GitHub Advisory Database (reviewed) High CVE-2021-38266

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.portal.security.ldap.impl	< 2.0.19	2.0.19
Maven	com.liferay.portal:release.dxp.bom	< 7.3.0-ga1	7.3.0-ga1

Details

As written in the advisory (Markdown source, shown as plain text).

Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-38266 advisory
https://github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736 web
https://github.com/liferay/liferay-portal package
https://issues.liferay.com/browse/LPE-17191 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673&_com_li… web