CVE-2021-38266
Liferay Portal and Liferay DXP fails to properly import users from LDAP
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
- Record
CVE-2021-38266- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
- Record
CVE-2021-38266- Updated
- 2026-11-02
EUVDEUVD-2021-24724 No score
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
- Record
EUVD-2021-24724- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jp3m-vh3g-6ggp
Liferay Portal and Liferay DXP fails to properly import users from LDAP
Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.
- Record
GHSA-jp3m-vh3g-6ggp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
- Record
CVE-2021-38266- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-jp3m-vh3g-6ggp
Liferay Portal and Liferay DXP fails to properly import users from LDAP
Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.
- Record
GHSA-jp3m-vh3g-6ggp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-liferay-2021-38266 No score
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
- Record
BIT-liferay-2021-38266- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.portal.security.ldap.implMaven |
before 2.0.19 | 2.0.19 |
com.liferay.portal:release.dxp.bomMaven |
before 7.3.0-ga1 | 7.3.0-ga1 |
liferayBitnami |
7.0.0 to 7.0.0, 7.1.0 to 7.1.0, 7.2.0 to 7.2.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.0-fix.0 to 7.0-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.1-fix.0 to 7.1-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0 | None known |
com.liferay:com.liferay.portal.security.ldap.implMaven |
before 2.0.19, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.241.0.251.0.261.0.271.0.281.0.291.0.31.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.371.0.381.0.391.0.41.0.401.0.411.0.421.0.431.0.441.0.451.0.461.0.471.0.481.0.491.0.51.0.501.0.511.0.521.0.53 |
2.0.19 |
com.liferay.portal:release.dxp.bomMaven |
before 7.3.0-ga1, plus listed versions 7.0.10.147.0.10.14-17.0.10.167.0.10.177.0.10.7 Show 45 moreShow less7.0.10.87.0.10.97.0.10.fp1007.0.10.fp1017.0.10.fp1027.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp637.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-1 |
7.3.0-ga1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38266 is a high vulnerability (CVSS 7.5) in Liferay Portal, published March 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in com.liferay:com.liferay.portal.security.ldap.impl 2.0.19.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38266
issues.liferay.com/browse/LPE-17191
nvd.nist.gov/vuln/detail/CVE-2021-38266
github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611673%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
liferay.com
Left out here: 94 versions. The JSON record has them.