CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2021-29040
Medium (5.3) in liferay. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.3.5.
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-209
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-87x7-pwrx-jch7 | Maven | com.liferay.portal:release.portal.bom | <7.3.5 | 7.3.5 |
| GHSA-87x7-pwrx-jch7 | Maven | com.liferay.portal:release.dxp.bom | <7.0.10.fp97 | 7.0.10.fp97 |
| GHSA-87x7-pwrx-jch7 | Maven | com.liferay.portal:release.dxp.bom | >=7.1.0 <7.1.10.fp20 | 7.1.10.fp20 |
| GHSA-87x7-pwrx-jch7 | Maven | com.liferay.portal:release.dxp.bom | >=7.2.0 <7.2.10.fp10 | 7.2.10.fp10 |