CVE-2021-29041: Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module

May 24, 2022 (updated May 14, 2025)

Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the other user’s TOTP shared secret.

References

github.com/advisories/GHSA-82j7-2h3j-hc7f
github.com/liferay/liferay-portal
issues.liferay.com/browse/LPE-17131
nvd.nist.gov/vuln/detail/CVE-2021-29041

Code Behaviors & Features

Detect and mitigate CVE-2021-29041 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →