CVE-2021-29041
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A denial-of-service vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by enabling TOTP on behalf of another user or modifying the other user's TOTP shared secret.
Risk Assessment
The organization is at risk of complete user access denial, potentially leading to operational disruption and loss of productivity.
Recommendation
Apply fix pack 1 for Liferay DXP 7.3 or later immediately to remediate the vulnerability.
Original NVD description (English source)
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user's TOTP shared secret.