CVE-2021-29040
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.
Risk Assessment
The organization is at risk of information disclosure about the internal system structure, which can help an attacker conduct precise attacks such as code injection or privilege escalation.
Recommendation
Immediately update Liferay Portal to version 7.3.5 or later, and Liferay DXP to the appropriate fix pack (97 for 7.0, 20 for 7.1, 10 for 7.2). Additionally, configure the server to avoid revealing detailed error messages.
Original NVD description (English source)
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.