CVE-2021-33327 — Incorrect Default Permissions in Portal

CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 71.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay Digital Experience Platform
Timeline
PublishedAug 3
Latest updateMay 24

Description

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDliferay/liferay_portal7.2.0 — 7.3.4

Patches

Patch: issues.liferay.com ↗Patch: issues.liferay.com ↗

🔴Vulnerability Details

3
GHSA
Liferay Portal and Liferay DXP does not properly check user permission↗2022-05-24
▶
OSV
Liferay Portal and Liferay DXP does not properly check user permission↗2022-05-24
▶
CVEList
CVE-2021-33327: The Portlet Configuration module in Liferay Portal 7↗2021-08-03
▶
CVE-2021-33327 — Incorrect Default Permissions | cvebase