Basic and Digest Authentication method ignores password policies

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 6.1 EE GA3 (6.1.30), 6.2 EE GA1 (6.2.10)
• Fix Version/s: 6.1.X EE, 6.2.X EE
• Component/s: Security Vulnerability
• Labels:
  • 61-ee-ga3-sp5
  • 62-ee-sp15
  • liferay-fixpack-portal-58-6130
  • liferay-fixpack-portal-80-6210

When a user tries to access a WebDAV url the password policy set for the users is not taken into account, hence a potential attacker can use this method to bruteforce attack.