| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.portal:release.dxp.bom | < 7.3.0-ga1 | 7.3.0-ga1 |
| com.liferay:com.liferay.portal.security.ldap.impl | < 2.0.19 | 2.0.19 |
| digital experience platform | = 7.0= 7.1= 7.2 | |
| liferay portal | ≤ 7.2.1 |
Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free