CVE-2021-29040: 
Java vulnerability analysis and mitigation

CVE-2021-29040 is a security vulnerability discovered in Liferay Portal 7.3.4 and earlier versions, as well as Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10. The vulnerability was published on May 16, 2021, and involves overly verbose error messages in JSON web services that could potentially aid attackers in launching more focused attacks (NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (MEDIUM) and a CVSS v2.0 Base Score of 5.0 (MEDIUM). The vulnerability is categorized under CWE-209 (Generation of Error Message Containing Sensitive Information). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N) (NVD).

When exploited, this vulnerability allows remote attackers to gather sensitive information from error messages, which can be used to facilitate more targeted and sophisticated attacks against the system. The vulnerability primarily affects the confidentiality of the system, with no direct impact on integrity or availability (NVD).

The vulnerability can be exploited remotely through network access, with low attack complexity and without requiring any privileges or user interaction. Attackers can craft specific inputs to trigger verbose error messages that may contain sensitive information (NVD).

Organizations using affected versions should upgrade to the following versions: Liferay Portal versions after 7.3.4, Liferay DXP 7.0 fix pack 97 or later, DXP 7.1 fix pack 20 or later, or DXP 7.2 fix pack 10 or later (Liferay).