Vulnerability Description
Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Liferay | Digital Experience Platform | 7.2 |
| Liferay | Liferay Portal | >= 7.2.0, < 7.3.3 |
References
- https://issues.liferay.com/browse/LPE-17127PatchVendor Advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisheRelease NotesVendor Advisory
- https://issues.liferay.com/browse/LPE-17127PatchVendor Advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisheRelease NotesVendor Advisory
FAQ
What is CVE-2021-33330?
CVE-2021-33330 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal ...
How severe is CVE-2021-33330?
CVE-2021-33330 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-33330?
Check the references section above for vendor advisories and patch information. Affected products include: Liferay Digital Experience Platform, Liferay Liferay Portal.