PT-2021-20112 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33331

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.3.1 Liferay DXP versions 7.0 through 7.0 before fix pack 94 Liferay DXP versions 7.1 through 7.1 before fix pack 19 Liferay DXP versions 7.2 through 7.2 before fix pack 8

Description The issue concerns an open redirect vulnerability in the Notifications module. This vulnerability allows remote attackers to redirect users to arbitrary external URLs via the redirect parameter.

Recommendations For Liferay Portal versions 7.0.0 through 7.3.1, update to a version outside of this range to resolve the issue. For Liferay DXP version 7.0, apply fix pack 94 or later to address the vulnerability. For Liferay DXP version 7.1, apply fix pack 19 or later to resolve the issue. For Liferay DXP version 7.2, apply fix pack 8 or later to address the vulnerability. As a temporary workaround, consider restricting access to the Notifications module or avoiding the use of the redirect parameter until a patch is available.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-33331

GHSA-MJ8W-H522-JWM8

Affected Products

Liferay Dxp

Liferay Portal

References · 6

• https://osv.dev/vulnerability/GHSA-mj8w-h522-jwm8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33331 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33331 · Security Note
• https://github.com/liferay/liferay-portal · Note