CVE-2021-33324: Medium severity liferay 7.4 ga vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2021-33324.

Q: What is the severity of CVE-2021-33324?

The severity of CVE-2021-33324 is medium.

Q: What is affected software by CVE-2021-33324?

The affected software by CVE-2021-33324 is Liferay Portal 7.1.0 through 7.3.1 and Liferay DXP 7.1 before fix pack 20 and 7.2 before fix pack 5.

Q: How does CVE-2021-33324 impact users?

CVE-2021-33324 allows remote authenticated users without view permission of a page to view the page via a site's page administration.

Q: Where can I find more information about CVE-2021-33324?

You can find more information about CVE-2021-33324 at the following links: https://issues.liferay.com/browse/LPE-17001, https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063.

Published Aug 3, 2021

Updated

The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.

Affected Software

54 affected componentsFixes available

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay Liferay Portal>=7.1.0<7.3.2

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

maven/com.liferay.portal:release.portal.bom>=7.1.0<=7.3.1

7.3.2

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp5

7.2.10.fp5

maven/com.liferay.portal:release.dxp.bom<7.1.10.fp20

7.1.10.fp20

Remediation

Patch Available

https://issues.liferay.com/browse/LPE-17001

Event History

Aug 3, 2021

CVE Published

via MITRE·06:24 PM

Data Sourced

via MITRE·06:24 PM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:09 PM

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-33324.

What is the severity of CVE-2021-33324?