{"id":"CVE-2021-38266","aliases":["BIT-liferay-2021-38266","EUVD-2021-24724","GHSA-jp3m-vh3g-6ggp"],"status":"published","title":"Liferay Portal and Liferay DXP fails to properly import users from LDAP","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01742,"percentile":0.7809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-03-02T23:00:44Z","modified":"2026-10-24T10:30:30Z","fixes":[{"ecosystem":"Maven","package":"com.liferay:com.liferay.portal.security.ldap.impl","fixed_in":["2.0.19"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","fixed_in":["7.3.0-ga1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.liferay:com.liferay.portal.security.ldap.impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.0-ga1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"liferay","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.0"},{"introduced":"7.1.0"},{"last_affected":"7.1.0"},{"introduced":"7.2.0"},{"last_affected":"7.2.0"}]},{"type":"SEMVER","events":[{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.0-fix.0"},{"last_affected":"7.0-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.1-fix.0"},{"last_affected":"7.1-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.liferay:com.liferay.portal.security.ldap.impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.31","1.0.32","1.0.33","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.41","1.0.42","1.0.43","1.0.44","1.0.45","1.0.46","1.0.47","1.0.48","1.0.49","1.0.5","1.0.50","1.0.51","1.0.52","1.0.53","1.0.6","1.0.7","1.0.8","1.0.9","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"Maven","package":"com.liferay.portal:release.dxp.bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.0-ga1"}]}],"versions":["7.0.10.14","7.0.10.14-1","7.0.10.16","7.0.10.17","7.0.10.7","7.0.10.8","7.0.10.9","7.0.10.fp100","7.0.10.fp101","7.0.10.fp102","7.0.10.fp60","7.0.10.fp61","7.0.10.fp62","7.0.10.fp63","7.0.10.fp64","7.0.10.fp65","7.0.10.fp66","7.0.10.fp67","7.0.10.fp68","7.0.10.fp69","7.0.10.fp70","7.0.10.fp71","7.0.10.fp72","7.0.10.fp73","7.0.10.fp74","7.0.10.fp75","7.0.10.fp76","7.0.10.fp77","7.0.10.fp78","7.0.10.fp79","7.0.10.fp80","7.0.10.fp81","7.0.10.fp82","7.0.10.fp83","7.0.10.fp84","7.0.10.fp85","7.0.10.fp85-1","7.0.10.fp86","7.0.10.fp86-1","7.0.10.fp87","7.0.10.fp87-1","7.0.10.fp88","7.0.10.fp89","7.0.10.fp90","7.0.10.fp91","7.0.10.fp92","7.0.10.fp94","7.0.10.fp94-1","7.0.10.fp95","7.0.10.fp95-1","7.0.10.fp95-2","7.0.10.fp97","7.0.10.fp98","7.1.10","7.1.10.1","7.1.10.3","7.1.10.4","7.1.10.5","7.1.10.6","7.1.10.7","7.1.10.8","7.1.10.fp1","7.1.10.fp10","7.1.10.fp11","7.1.10.fp12","7.1.10.fp13","7.1.10.fp14","7.1.10.fp15","7.1.10.fp16","7.1.10.fp17","7.1.10.fp18","7.1.10.fp19","7.1.10.fp2","7.1.10.fp20","7.1.10.fp22","7.1.10.fp24","7.1.10.fp25","7.1.10.fp26","7.1.10.fp27","7.1.10.fp28","7.1.10.fp3","7.1.10.fp4","7.1.10.fp5","7.1.10.fp6","7.1.10.fp7","7.1.10.fp8","7.1.10.fp9","7.2.1","7.2.10","7.2.10.1","7.2.10.2","7.2.10.3","7.2.10.3-1","7.2.10.4","7.2.10.4-1","7.2.10.5","7.2.10.5-1","7.2.10.6","7.2.10.7","7.2.10.8","7.2.10.fp1","7.2.10.fp1-1","7.2.10.fp10","7.2.10.fp11","7.2.10.fp12","7.2.10.fp13","7.2.10.fp14","7.2.10.fp15","7.2.10.fp16","7.2.10.fp17","7.2.10.fp18","7.2.10.fp19","7.2.10.fp2","7.2.10.fp20","7.2.10.fp3","7.2.10.fp4","7.2.10.fp5","7.2.10.fp6","7.2.10.fp7","7.2.10.fp8","7.2.10.fp9"]}],"products":[{"vendor":"liferay","product":"digital_experience_platform"},{"vendor":"liferay","product":"liferay_portal"}],"references":[{"url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38266","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://issues.liferay.com/browse/LPE-17191","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38266","tags":["advisory"]},{"url":"https://github.com/liferay/liferay-portal/commit/c3d1e3c7b18be0791360bb57428ea8234bcbb736","tags":["web"]},{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38266?p_r_p_assetEntryId=121611673\u0026_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611673%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jp3m-vh3g-6ggp"},{"url":"http://liferay.com","tags":["web"]},{"url":"https://github.com/liferay/liferay-portal","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-38266","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","status":"published","published":"2022-03-02T23:00:44Z","modified":"2026-07-09T00:14:37.927Z","updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-24724","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","status":"published","published":"2022-03-02T23:00:44Z","modified":"2026-07-09T00:14:37Z","updated_at":"2026-11-02T18:20:08.60883Z"}],"ghsa":[{"id":"GHSA-jp3m-vh3g-6ggp","title":"Liferay Portal and Liferay DXP fails to properly import users from LDAP","description":"Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.","status":"published","published":"2022-03-04T00:00:22Z","modified":"2025-07-14T20:52:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2021-38266","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","status":"published","published":"2022-03-02T23:15:08.577Z","modified":"2026-07-09T01:17:00.57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:05.198719Z"}],"osv":[{"id":"CVE-2021-38266","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","status":"published","published":"2022-03-02T23:15:08.577Z","modified":"2026-10-24T10:30:30.943150735Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"GHSA-jp3m-vh3g-6ggp","title":"Liferay Portal and Liferay DXP fails to properly import users from LDAP","description":"Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP.","status":"published","published":"2022-03-04T00:00:22Z","modified":"2025-07-14T21:12:12.34413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"BIT-liferay-2021-38266","description":"The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.","status":"published","published":"2024-01-31T15:22:00.2Z","modified":"2025-07-14T21:12:12.34413Z","updated_at":"2026-11-02T15:28:32.162822Z"}]}}