CVE-2021-33321

Vulnerability

Liferay Portal versions 6.2.3 through 7.3.2 and Liferay DXP versions before 7.3 ship with an insecure default configuration where the property login.secure.forgot.password is set to false [1][2][3]. This property controls whether the forgot password feature reveals whether a given email address is registered. When set to false, the feature returns different responses for registered and unregistered email addresses, enabling user enumeration [3].

Exploitation

An unauthenticated remote attacker can exploit this by sending a forgot password request for a target email address. If the email is registered, the system returns a success message; if not, it returns an error or different response. No special privileges or network position beyond standard HTTP access are required [3].

Impact

Successful exploitation allows an attacker to enumerate valid user email addresses associated with the Liferay instance. This information disclosure can be used to target specific users for further attacks, such as phishing or credential stuffing [3].

Mitigation

The fix was implemented in commits that changed the default value of login.secure.forgot.password to true [1][2]. Administrators should ensure this property is explicitly set to true in portal-ext.properties or upgrade to a patched version (Liferay Portal 7.3.3 or later, Liferay DXP 7.3 or later). If upgrading is not immediately possible, setting the property to true mitigates the enumeration risk [3].