What’s Vulnerable › Vulnerabilities

CVE-2021-29040

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-16 · updated 2026-07-09
• Weakness: CWE-209

Description

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs.

Affected products

• Liferay Digital Experience Platform: before 7.0; 7.0, 7.0-fix_pack_13, 7.0-fix_pack_14, 7.0-fix_pack_24, 7.0-fix_pack_25, 7.0-fix_pack_26 (+90) — fixed in 7.0
• Liferay Portal: through 7.3.4

How to fix

Upgrade to a fixed version: Liferay Digital Experience Platform 7.0. Check the vendor advisory for mitigations.

References

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120743429

Get alerted when CVE-2021-29040 or the next vulnerability affects your stack