PT-2021-20101 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2025-05-13 · CVE-2021-33320

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.1 and earlier Liferay DXP versions 7.0 through 7.0 before fix pack 96 Liferay DXP versions 7.1 through 7.1 before fix pack 20 Liferay DXP versions 7.2 through 7.2 before fix pack 5

Description The issue concerns the Flags module, which does not limit the rate at which content can be flagged as inappropriate. This allows remote authenticated users to spam the site administrator with emails.

Recommendations For Liferay Portal versions 7.3.1 and earlier, update to a version later than 7.3.1. For Liferay DXP versions 7.0 through 7.0 before fix pack 96, apply fix pack 96 or later. For Liferay DXP versions 7.1 through 7.1 before fix pack 20, apply fix pack 20 or later. For Liferay DXP versions 7.2 through 7.2 before fix pack 5, apply fix pack 5 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-33320

GHSA-WG4X-HF94-FJ5V

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://issues.liferay.com/browse/LPE-17007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33320 · Security Note
• https://osv.dev/vulnerability/GHSA-wg4x-hf94-fj5v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33320 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747590 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/122021 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33320-flagging-content-as-inappropriate-is-not-rate-limited?p_r_p_assetEntryId=121611464&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611464%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note