Description
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | >= 7.0.0, < 7.0.10.fp89 | 7.0.10.fp89 | GHSA-773f-f929-qgjj |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.1.0, < 7.1.10.fp17 | 7.1.10.fp17 | GHSA-773f-f929-qgjj |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.2.0, < 7.2.10.fp4 | 7.2.10.fp4 | GHSA-773f-f929-qgjj |
| Maven | com.liferay.portal:release.portal.bom | < 7.3.0 | 7.3.0 | GHSA-773f-f929-qgjj |