PT-2021-20105 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33324

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.3.1 Liferay DXP versions 7.1 before fix pack 20 Liferay DXP versions 7.2 before fix pack 5

Description The Layout module does not properly check permission of pages, allowing remote authenticated users without view permission of a page to view the page via a site's page administration.

Recommendations For Liferay Portal versions 7.1.0 through 7.3.1, update to a version that includes the fix for the permission checking issue. For Liferay DXP versions 7.1 before fix pack 20, apply fix pack 20 or later to resolve the issue. For Liferay DXP versions 7.2 before fix pack 5, apply fix pack 5 or later to resolve the issue. As a temporary workaround, consider restricting access to the site's page administration for remote authenticated users without view permission of a page.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-33324

GHSA-474F-CMX5-GM69

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33324 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33324 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-474f-cmx5-gm69 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/19113 · Telegram Post
• https://web.archive.org/web/20220828222955/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063 · Note