CVE-2021-33338: CSRF

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2021-33338.

Q: What is the severity level of CVE-2021-33338?

The severity level of CVE-2021-33338 is high, with a severity value of 7.5.

Q: Which software versions are affected by CVE-2021-33338?

CVE-2021-33338 affects Liferay Portal versions 7.1.0 through 7.3.2 and Liferay DXP versions 7.1 before fix pack 19 and 7.2 before fix pack 6.

Q: What is the impact of CVE-2021-33338?

CVE-2021-33338 allows man-in-the-middle attackers to conduct Cross-Site Request Forgery (CSRF) attacks by obtaining the CSRF token from the exposed p_auth parameter in URLs.

Q: How can I fix CVE-2021-33338?

To fix CVE-2021-33338, you should apply the relevant fix packs for Liferay DXP or Liferay Portal as mentioned in the provided references.

Published Aug 4, 2021

Updated

The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the pauth parameter.

Affected Software

54 affected componentsFixes available

Liferay DXP=7.1

Liferay DXP=7.1-fix_pack_1

Liferay DXP=7.1-fix_pack_10

Liferay DXP=7.1-fix_pack_11

Liferay DXP=7.1-fix_pack_12

Liferay DXP=7.1-fix_pack_13

Liferay DXP=7.1-fix_pack_14

Liferay DXP=7.1-fix_pack_15

Liferay DXP=7.1-fix_pack_16

Liferay DXP=7.1-fix_pack_17

Liferay DXP=7.1-fix_pack_18

Liferay DXP=7.1-fix_pack_2

Liferay DXP=7.1-fix_pack_3

Liferay DXP=7.1-fix_pack_4

Liferay DXP=7.1-fix_pack_5

Liferay DXP=7.1-fix_pack_6

Liferay DXP=7.1-fix_pack_7

Liferay DXP=7.1-fix_pack_8

Liferay DXP=7.1-fix_pack_9

Liferay DXP=7.2

Liferay DXP=7.2-fix_pack_1

Liferay DXP=7.2-fix_pack_2

Liferay DXP=7.2-fix_pack_3

Liferay DXP=7.2-fix_pack_4

Liferay DXP=7.2-fix_pack_5

Liferay Liferay Portal>=7.1.0<=7.3.2

Liferay Digital Experience Platform=7.1

Liferay Digital Experience Platform=7.1-fix_pack_1

Liferay Digital Experience Platform=7.1-fix_pack_10

Liferay Digital Experience Platform=7.1-fix_pack_11

Liferay Digital Experience Platform=7.1-fix_pack_12

Liferay Digital Experience Platform=7.1-fix_pack_13

Liferay Digital Experience Platform=7.1-fix_pack_14

Liferay Digital Experience Platform=7.1-fix_pack_15

Liferay Digital Experience Platform=7.1-fix_pack_16

Liferay Digital Experience Platform=7.1-fix_pack_17

Liferay Digital Experience Platform=7.1-fix_pack_18

Liferay Digital Experience Platform=7.1-fix_pack_2

Liferay Digital Experience Platform=7.1-fix_pack_3

Liferay Digital Experience Platform=7.1-fix_pack_4

Liferay Digital Experience Platform=7.1-fix_pack_5

Liferay Digital Experience Platform=7.1-fix_pack_6

Liferay Digital Experience Platform=7.1-fix_pack_7

Liferay Digital Experience Platform=7.1-fix_pack_8

Liferay Digital Experience Platform=7.1-fix_pack_9

Liferay Digital Experience Platform=7.2

Liferay Digital Experience Platform=7.2-fix_pack_1

Liferay Digital Experience Platform=7.2-fix_pack_2

Liferay Digital Experience Platform=7.2-fix_pack_3

Liferay Digital Experience Platform=7.2-fix_pack_4

Liferay Digital Experience Platform=7.2-fix_pack_5

maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp6

7.2.10.fp6

maven/com.liferay.portal:release.dxp.bom>=7.1.0<7.1.10.fp19

7.1.10.fp19

maven/com.liferay.portal:release.portal.bom>=7.1.0<=7.3.2

7.3.3

Event History

Aug 4, 2021

CVE Published

via MITRE·01:07 PM

Data Sourced

via MITRE·01:07 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:10 PM

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID of this vulnerability is CVE-2021-33338.

What is the severity level of CVE-2021-33338?

The severity level of CVE-2021-33338 is high, with a severity value of 7.5.

Which software versions are affected by CVE-2021-33338?