CVE-2021-38266: 
Java vulnerability analysis and mitigation

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 contains a vulnerability in its LDAP user import functionality. The vulnerability was assigned identifier CVE-2021-38266 and was disclosed on August 30, 2021. This security issue affects the authentication mechanism when importing users from LDAP systems (Liferay Advisory).

The vulnerability stems from incorrect implementation of LDAP user import functionality in the Portal Security module. According to the National Vulnerability Database, this vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability allows remote attackers to prevent legitimate users from authenticating to the system. This is achieved by attempting to sign in as a user that exists in LDAP, effectively creating a denial of service condition for legitimate LDAP users (CVE).

For Liferay Portal, version 7.3.0 provides a fix for this vulnerability. For version 7.2.1, a source patch is available. Users of Liferay Portal 7.1 and earlier versions are advised to upgrade to Liferay Portal 7.3 as no direct fixes are available for these versions (Liferay Advisory).