CVE-2021-33323 — Cleartext Storage of Sensitive Info in Portal

CWE-312 — Cleartext Storage of Sensitive Info4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 38.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay Digital Experience Platform
Timeline
PublishedAug 3
Latest updateMay 24

Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDliferay/liferay_portal7.1.0 — 7.3.1

Patches

Patch: issues.liferay.com ↗Patch: issues.liferay.com ↗

🔴Vulnerability Details

3
OSV
Liferay Portal and Liferay DXP autosaves form data for other users to see↗2022-05-24
▶
GHSA
Liferay Portal and Liferay DXP autosaves form data for other users to see↗2022-05-24
▶
CVEList
CVE-2021-33323: The Dynamic Data Mapping module in Liferay Portal 7↗2021-08-03
▶
CVE-2021-33323 — Cleartext Storage of Sensitive Info | cvebase