Password change does not invalidate password reset tokens

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.0 DE (7.0.10), 7.1 DXP (7.1.10), 7.2 DXP (7.2.10)
• Fix Version/s: 7.0.X EE, 7.1.x EE, 7.2.X EE
• Component/s: Application Security > Password, Security Vulnerability
• Labels:
  • liferay-dxp-70-sp15
  • liferay-dxp-72-sp2
  • liferay-fixpack-de-96-7010
  • liferay-fixpack-dxp-18-7110
  • liferay-fixpack-dxp-5-7210
• CVE IDs: CVE-2021-33322
• CVSS Base Score: 6.5
• CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
• 7.0 Fix Pack Version: 96
• 7.1 Fix Pack Version: 18
• 7.2 Fix Pack Version: 5

Password reset tokens in Liferay DXP 7.0, 7.1, and 7.2 are not invalidated after users changes their password, which allows remote attackers to change users password via the invalidated password reset token.