PT-2021-20115 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33334

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.3.2 Liferay DXP 7.0 before fix pack 94 Liferay DXP 7.1 before fix pack 19 Liferay DXP 7.2 before fix pack 6

Description The Dynamic Data Mapping module does not properly check user permissions, allowing remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration.

Recommendations For Liferay Portal versions 7.0.0 through 7.3.2, update to a version that includes the fix for this issue. For Liferay DXP 7.0, apply fix pack 94 or later. For Liferay DXP 7.1, apply fix pack 19 or later. For Liferay DXP 7.2, apply fix pack 6 or later. As a temporary workaround, consider restricting access to the forms section in site administration to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-33334

GHSA-G37F-J8HH-736F

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://issues.liferay.com/browse/LPE-17039 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33334 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g37f-j8hh-736f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33334 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/26786 · Telegram Post
• https://t.me/cvenotify/19138 · Telegram Post