CVE-2021-29043: 
Java vulnerability analysis and mitigation

CVE-2021-29043 affects the Portal Store module in Liferay Portal versions 7.0.0 through 7.3.5, and Liferay DXP versions 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 1. The vulnerability was discovered and disclosed in March 2021, with the CVE being published on May 17, 2021 (NVD).

The vulnerability stems from the Portal Store module's failure to obfuscate the S3 store's proxy password. This security flaw has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness is categorized as CWE-522 (Insufficiently Protected Credentials) (NVD).

The vulnerability allows attackers to steal the proxy password through man-in-the-middle attacks or shoulder surfing. This exposure of sensitive credentials could potentially lead to unauthorized access to the S3 store and compromise of stored data (CVE).

Users should upgrade to the following versions based on their deployment: Liferay DXP 7.0 fix pack 97 or later, 7.1 fix pack 21 or later, 7.2 fix pack 10 or later, or 7.3 fix pack 1 or later (Liferay).