CVE-2021-33335: High severity liferay 7.4 ga vulnerability

Q: What is CVE-2021-33335?

CVE-2021-33335 is a privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4 and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9.

Q: How can this vulnerability be exploited?

This vulnerability can be exploited by remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator us.

Q: What is the severity of CVE-2021-33335?

CVE-2021-33335 has a severity rating of high.

Q: What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

The CWE ID for CVE-2021-33335 is CWE-863.

Q: Are there any known fix or mitigation steps?

To mitigate this vulnerability, it is recommended to apply the relevant fix packs provided by Liferay Portal and Liferay DXP.

Published Aug 3, 2021

Updated

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Affected Software

62 affected componentsFixes available

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_19

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay DXP=7.2-fix_pack_6

Liferay DXP=7.2-fix_pack_7

Liferay DXP=7.2-fix_pack_8

Liferay Liferay Portal>=7.0.3<7.3.5

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_19

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

Liferay Digital Experience Platform=7.2-fix_pack_6

Liferay Digital Experience Platform=7.2-fix_pack_7

Liferay Digital Experience Platform=7.2-fix_pack_8

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp9

7.2.10.fp9

maven/com.liferay.portal:release.dxp.bom>=7.1.0<7.1.10.fp20

7.1.10.fp20

maven/com.liferay.portal:release.portal.bom>=7.0.3<=7.3.4

7.3.5

Remediation

Patch Available

https://issues.liferay.com/browse/LPE-17103

Event History

Aug 3, 2021

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

Description

Data Sourced

via NVD·10:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:10 PM

Frequently Asked Questions

What is CVE-2021-33335?

CVE-2021-33335 is a privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4 and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9.

How can this vulnerability be exploited?