PT-2022-10708 · Liferay · Liferay Portal+1

Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38268

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.0.0 through 7.3.6 Liferay DXP versions 7.0 through 7.3 before fix pack 2, with the following specific fix pack requirements:

• 7.0 before fix pack 101
• 7.1 before fix pack 21
• 7.2 before fix pack 10

Description The Dynamic Data Mapping module in Liferay Portal and Liferay DXP incorrectly sets default permissions for site members. This allows remote authenticated users with the site member role to add and duplicate forms via the UI or the API.

Recommendations For Liferay Portal versions 7.0.0 through 7.3.6, update to a version with the appropriate fix pack or later. For Liferay DXP version 7.0, apply fix pack 101 or later. For Liferay DXP version 7.1, apply fix pack 21 or later. For Liferay DXP version 7.2, apply fix pack 10 or later. For Liferay DXP version 7.3, apply fix pack 2 or later. As a temporary workaround, consider restricting the site member role permissions to prevent unauthorized form additions and duplications.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BIT-LIFERAY-2021-38268

CVE-2021-38268

GHSA-F855-2RVM-5J7H

Affected Products

Liferay Dxp

Liferay Portal

References · 13

• https://osv.dev/vulnerability/BIT-liferay-2021-38268 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38268 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38268 · Security Note
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f855-2rvm-5j7h · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/16228425d7395b564f3c4cb5fae0c71c7228202b · Note
• https://liferay.atlassian.net/browse/LPE-17150 · Note
• https://t.me/cibsecurity/38319 · Telegram Post
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38268-site-member-can-add-new-forms-by-default?p_r_p_assetEntryId=121611813&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611813%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/27619 · Telegram Post