UpHeron
All vulnerabilities

Servers and applications

CVE-2021-29040

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

Severity
Medium 5.3
Published
16 May 2021
Last changed
9 Jul 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.0
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.2-fix_pack_9
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_6
All 97 release lines
  • Every version before 7.0
  • Version 7.0
  • Version 7.0-fix_pack_3
  • Version 7.0-fix_pack_13
  • Version 7.0-fix_pack_14
  • Version 7.0-fix_pack_24
  • Version 7.0-fix_pack_25
  • Version 7.0-fix_pack_26
  • Version 7.0-fix_pack_27
  • Version 7.0-fix_pack_28
  • Version 7.0-fix_pack_30
  • Version 7.0-fix_pack_33
  • Version 7.0-fix_pack_35
  • Version 7.0-fix_pack_36
  • Version 7.0-fix_pack_39
  • Version 7.0-fix_pack_40
  • Version 7.0-fix_pack_41
  • Version 7.0-fix_pack_42
  • Version 7.0-fix_pack_43
  • Version 7.0-fix_pack_44
  • Version 7.0-fix_pack_45
  • Version 7.0-fix_pack_46
  • Version 7.0-fix_pack_47
  • Version 7.0-fix_pack_48
  • Version 7.0-fix_pack_49
  • Version 7.0-fix_pack_50
  • Version 7.0-fix_pack_51
  • Version 7.0-fix_pack_52
  • Version 7.0-fix_pack_53
  • Version 7.0-fix_pack_54
  • Version 7.0-fix_pack_56
  • Version 7.0-fix_pack_57
  • Version 7.0-fix_pack_58
  • Version 7.0-fix_pack_59
  • Version 7.0-fix_pack_60
  • Version 7.0-fix_pack_61
  • Version 7.0-fix_pack_64
  • Version 7.0-fix_pack_65
  • Version 7.0-fix_pack_66
  • Version 7.0-fix_pack_67
  • Version 7.0-fix_pack_68
  • Version 7.0-fix_pack_69
  • Version 7.0-fix_pack_70
  • Version 7.0-fix_pack_71
  • Version 7.0-fix_pack_72
  • Version 7.0-fix_pack_73
  • Version 7.0-fix_pack_75
  • Version 7.0-fix_pack_76
  • Version 7.0-fix_pack_78
  • Version 7.0-fix_pack_79
  • Version 7.0-fix_pack_80
  • Version 7.0-fix_pack_81
  • Version 7.0-fix_pack_82
  • Version 7.0-fix_pack_83
  • Version 7.0-fix_pack_84
  • Version 7.0-fix_pack_85
  • Version 7.0-fix_pack_86
  • Version 7.0-fix_pack_87
  • Version 7.0-fix_pack_88
  • Version 7.0-fix_pack_89
  • Version 7.0-fix_pack_90
  • Version 7.0-fix_pack_91
  • Version 7.0-fix_pack_92
  • Version 7.0-fix_pack_93
  • Version 7.0-fix_pack_94
  • Version 7.0-fix_pack_95
  • Version 7.0-fix_pack_96
  • Version 7.1
  • Version 7.1-fix_pack_1
  • Version 7.1-fix_pack_2
  • Version 7.1-fix_pack_3
  • Version 7.1-fix_pack_4
  • Version 7.1-fix_pack_5
  • Version 7.1-fix_pack_6
  • Version 7.1-fix_pack_7
  • Version 7.1-fix_pack_8
  • Version 7.1-fix_pack_9
  • Version 7.1-fix_pack_10
  • Version 7.1-fix_pack_11
  • Version 7.1-fix_pack_12
  • Version 7.1-fix_pack_13
  • Version 7.1-fix_pack_14
  • Version 7.1-fix_pack_15
  • Version 7.1-fix_pack_16
  • Version 7.1-fix_pack_17
  • Version 7.1-fix_pack_18
  • Version 7.1-fix_pack_19
  • Version 7.2
  • Version 7.2-fix_pack_1
  • Version 7.2-fix_pack_2
  • Version 7.2-fix_pack_3
  • Version 7.2-fix_pack_4
  • Version 7.2-fix_pack_5
  • Version 7.2-fix_pack_6
  • Version 7.2-fix_pack_7
  • Version 7.2-fix_pack_8
  • Version 7.2-fix_pack_9
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • Every version up to 7.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-29040
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-29040