Security readout for executives and security teams
Plain-English summary
This flaw can cause Liferay to save new users' passwords in clear text in the database when user-creation workflow is enabled. If an attacker or insider can read the database, they may obtain real user passwords instead of only password hashes.
Executive priority
Treat this as high priority where affected Liferay systems handle employee, customer, or administrator accounts. The flaw can turn database access into direct password disclosure, increasing account takeover and password-reuse risk.
Technical view
CVE-2021-33325 affects the Portal Workflow module in Liferay Portal 7.3.2 and earlier, and specified older Liferay DXP fix-pack levels. The vulnerable condition is workflow-enabled user creation, which stores clear text passwords in the database and exposes credentials to anyone with database access.
Likely exposure
Exposure is likely limited to Liferay deployments using affected Portal or DXP versions with workflow enabled for user creation. Systems without that workflow path, or upgraded beyond the vendor-fixed fix packs, are less likely to be affected.
Exploitation context
The supplied sources do not show active exploitation, and CISA KEV status is false. Abuse requires access to the underlying database, so this is most relevant after database compromise, excessive DBA access, backup exposure, or insider misuse.
Researcher notes
The bundle provides affected version ranges and fixed DXP fix-pack thresholds, but no CVSS score, CWE, exploit evidence, or detailed database field information. Avoid assuming internet-exploitable impact; the stated prerequisite is database access.
Mitigation direction
- Inventory Liferay Portal and DXP versions across production and backups.
- For DXP 7.0, apply fix pack 93 or later.
- For DXP 7.1, apply fix pack 19 or later.
- For DXP 7.2, apply fix pack 7 or later.
- For Portal 7.3.2 and earlier, check Liferay guidance for the fixed upgrade path.
- Review database, backup, and administrator access for exposed clear text credentials.
Validation and detection
- Confirm whether Portal Workflow is enabled for user creation.
- Compare installed Liferay versions and fix packs against the affected ranges.
- Review the user-related workflow data store for clear text password exposure.
- Check database and backup access logs for unexpected reads by privileged accounts.
- Determine whether affected users reused passwords across other business systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-33325 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748389CVE reference · x_refsource_CONFIRM
- https://issues.liferay.com/browse/LPE-17042CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.