Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
References
| Link | Resource |
|---|---|
| https://issues.liferay.com/browse/LPE-17127 | Patch Vendor Advisory |
| https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo |
11 Aug 2021, 14:31
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 4.3 |
| CWE | CWE-668 | |
| References | (CONFIRM) https://issues.liferay.com/browse/LPE-17127 - Patch, Vendor Advisory | |
| References | (CONFIRM) https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720 - Release Notes, Vendor Advisory | |
| CPE | cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:* cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:* cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* |
03 Aug 2021, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-03 19:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-33330
Mitre link : CVE-2021-33330
CVE.ORG link : CVE-2021-33330
JSON object : View
Products Affected
liferay
- dxp
- liferay_portal
CWE