PT-2021-20108 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33327

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.3.3 Liferay DXP 7.0 fix pack 93 and 94 Liferay DXP 7.1 fix pack 18 Liferay DXP 7.2 before fix pack 8

Description The Portlet Configuration module does not properly check user permission, allowing remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

Recommendations For Liferay Portal versions 7.2.0 through 7.3.3, update to a version that includes the fix for this issue. For Liferay DXP 7.0 fix pack 93 and 94, apply a fix pack that addresses this issue. For Liferay DXP 7.1 fix pack 18, apply a fix pack that addresses this issue. For Liferay DXP 7.2 before fix pack 8, apply fix pack 8 or later to resolve the issue. As a temporary workaround, consider restricting access to the Portlet Configuration module until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-33327

GHSA-22WC-7WMM-V4CC

Affected Products

Liferay Dxp

Liferay Portal

References · 10

• https://osv.dev/vulnerability/GHSA-22wc-7wmm-v4cc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33327 · Security Note
• https://issues.liferay.com/browse/LPE-17075 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33327 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/9e1628110ca5f0b7b867e1f55e3886c92fc67ca1 · Note
• https://github.com/liferay/liferay-portal/commit/44317eb5274d24bb91c43c91cd5c678392eb9eeb · Note
• https://t.me/cvenotify/19107 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33327-unauthorized-users-can-view-the-guest-and-user-roles?p_r_p_assetEntryId=121611305&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611305%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0 · Note