GHSA-773f-f929-qgjj

Suggest an improvement
Source
https://github.com/advisories/GHSA-773f-f929-qgjj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-773f-f929-qgjj/GHSA-773f-f929-qgjj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-773f-f929-qgjj
Aliases
Published
2022-05-24T17:23:58Z
Modified
2025-05-28T20:57:11Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection
Details

Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.

Database specific 
{
    "cwe_ids":  [
        "CWE-522"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-05-28T19:58:56Z",
    "nvd_published_at":  "2020-07-20T02:15:00Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven
com.liferay.portal:release.portal.bom

Package

Name
com.liferay.portal:release.portal.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.3.0

Affected versions

7.*
7.0.6
7.0.6-1
7.0.6-2
7.1.0
7.1.1
7.1.2
7.1.3
7.1.3-1
7.2.0
7.2.1
7.2.1-1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-773f-f929-qgjj/GHSA-773f-f929-qgjj.json"
com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0.0
Fixed
7.0.10.fp89

Affected versions

7.*
7.0.10.fp60
7.0.10.fp61
7.0.10.fp62
7.0.10.fp63
7.0.10.fp64
7.0.10.fp65
7.0.10.fp66
7.0.10.fp67
7.0.10.fp68
7.0.10.fp69
7.0.10.fp70
7.0.10.fp71
7.0.10.fp72
7.0.10.fp73
7.0.10.fp74
7.0.10.fp75
7.0.10.fp76
7.0.10.fp77
7.0.10.fp78
7.0.10.fp79
7.0.10.fp80
7.0.10.fp81
7.0.10.fp82
7.0.10.fp83
7.0.10.fp84
7.0.10.fp85
7.0.10.fp85-1
7.0.10.fp86
7.0.10.fp86-1
7.0.10.fp87
7.0.10.fp87-1
7.0.10.fp88

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-773f-f929-qgjj/GHSA-773f-f929-qgjj.json"
com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.1.0
Fixed
7.1.10.fp17

Affected versions

7.*
7.1.10
7.1.10.fp1
7.1.10.fp2
7.1.10.fp3
7.1.10.fp4
7.1.10.fp5
7.1.10.fp6
7.1.10.fp7
7.1.10.fp8
7.1.10.fp9
7.1.10.fp10
7.1.10.fp11
7.1.10.fp12
7.1.10.fp13
7.1.10.fp14
7.1.10.fp15
7.1.10.fp16

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-773f-f929-qgjj/GHSA-773f-f929-qgjj.json"
com.liferay.portal:release.dxp.bom

Package

Name
com.liferay.portal:release.dxp.bom
View open source insights on deps.dev
Purl
pkg:maven/com.liferay.portal/release.dxp.bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.2.0
Fixed
7.2.10.fp4

Affected versions

7.*
7.2.1
7.2.10
7.2.10.fp1
7.2.10.fp1-1
7.2.10.fp2
7.2.10.fp3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-773f-f929-qgjj/GHSA-773f-f929-qgjj.json"