CVE-2021-33324
First published: Tue Aug 03 2021(Updated: )
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay DXP | =7.1 | |
| Liferay DXP | =7.1-fix_pack_1 | |
| Liferay DXP | =7.1-fix_pack_10 | |
| Liferay DXP | =7.1-fix_pack_11 | |
| Liferay DXP | =7.1-fix_pack_12 | |
| Liferay DXP | =7.1-fix_pack_13 | |
| Liferay DXP | =7.1-fix_pack_14 | |
| Liferay DXP | =7.1-fix_pack_15 | |
| Liferay DXP | =7.1-fix_pack_16 | |
| Liferay DXP | =7.1-fix_pack_17 | |
| Liferay DXP | =7.1-fix_pack_18 | |
| Liferay DXP | =7.1-fix_pack_19 | |
| Liferay DXP | =7.1-fix_pack_2 | |
| Liferay DXP | =7.1-fix_pack_3 | |
| Liferay DXP | =7.1-fix_pack_4 | |
| Liferay DXP | =7.1-fix_pack_5 | |
| Liferay DXP | =7.1-fix_pack_6 | |
| Liferay DXP | =7.1-fix_pack_7 | |
| Liferay DXP | =7.1-fix_pack_8 | |
| Liferay DXP | =7.1-fix_pack_9 | |
| Liferay DXP | =7.2 | |
| Liferay DXP | =7.2-fix_pack_1 | |
| Liferay DXP | =7.2-fix_pack_2 | |
| Liferay DXP | =7.2-fix_pack_3 | |
| Liferay DXP | =7.2-fix_pack_4 | |
| Liferay Liferay Portal | >=7.1.0<7.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-33324.
What is the severity of CVE-2021-33324?
The severity of CVE-2021-33324 is medium.
What is affected software by CVE-2021-33324?
The affected software by CVE-2021-33324 is Liferay Portal 7.1.0 through 7.3.1 and Liferay DXP 7.1 before fix pack 20 and 7.2 before fix pack 5.
How does CVE-2021-33324 impact users?
CVE-2021-33324 allows remote authenticated users without view permission of a page to view the page via a site's page administration.
Where can I find more information about CVE-2021-33324?
You can find more information about CVE-2021-33324 at the following links: https://issues.liferay.com/browse/LPE-17001, https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063.
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/liferay
- canonical/liferay dxp
- version/liferay dxp/7.1
- version/liferay dxp/7.1-fix_pack_1
- version/liferay dxp/7.1-fix_pack_10
- version/liferay dxp/7.1-fix_pack_11
- version/liferay dxp/7.1-fix_pack_12
- version/liferay dxp/7.1-fix_pack_13
- version/liferay dxp/7.1-fix_pack_14
- version/liferay dxp/7.1-fix_pack_15
- version/liferay dxp/7.1-fix_pack_16
- version/liferay dxp/7.1-fix_pack_17
- version/liferay dxp/7.1-fix_pack_18
- version/liferay dxp/7.1-fix_pack_19
- version/liferay dxp/7.1-fix_pack_2
- version/liferay dxp/7.1-fix_pack_3
- version/liferay dxp/7.1-fix_pack_4
- version/liferay dxp/7.1-fix_pack_5
- version/liferay dxp/7.1-fix_pack_6
- version/liferay dxp/7.1-fix_pack_7
- version/liferay dxp/7.1-fix_pack_8
- version/liferay dxp/7.1-fix_pack_9
- version/liferay dxp/7.2
- version/liferay dxp/7.2-fix_pack_1
- version/liferay dxp/7.2-fix_pack_2
- version/liferay dxp/7.2-fix_pack_3
- version/liferay dxp/7.2-fix_pack_4
- canonical/liferay liferay portal
- version/liferay liferay portal/7.1.0