CVE-2021-33338: CSRF
First published: Wed Aug 04 2021(Updated: )
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Liferay DXP | =7.1 | |
| Liferay DXP | =7.1-fix_pack_1 | |
| Liferay DXP | =7.1-fix_pack_10 | |
| Liferay DXP | =7.1-fix_pack_11 | |
| Liferay DXP | =7.1-fix_pack_12 | |
| Liferay DXP | =7.1-fix_pack_13 | |
| Liferay DXP | =7.1-fix_pack_14 | |
| Liferay DXP | =7.1-fix_pack_15 | |
| Liferay DXP | =7.1-fix_pack_16 | |
| Liferay DXP | =7.1-fix_pack_17 | |
| Liferay DXP | =7.1-fix_pack_18 | |
| Liferay DXP | =7.1-fix_pack_2 | |
| Liferay DXP | =7.1-fix_pack_3 | |
| Liferay DXP | =7.1-fix_pack_4 | |
| Liferay DXP | =7.1-fix_pack_5 | |
| Liferay DXP | =7.1-fix_pack_6 | |
| Liferay DXP | =7.1-fix_pack_7 | |
| Liferay DXP | =7.1-fix_pack_8 | |
| Liferay DXP | =7.1-fix_pack_9 | |
| Liferay DXP | =7.2 | |
| Liferay DXP | =7.2-fix_pack_1 | |
| Liferay DXP | =7.2-fix_pack_2 | |
| Liferay DXP | =7.2-fix_pack_3 | |
| Liferay DXP | =7.2-fix_pack_4 | |
| Liferay DXP | =7.2-fix_pack_5 | |
| Liferay Liferay Portal | >=7.1.0<=7.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2021-33338.
What is the severity level of CVE-2021-33338?
The severity level of CVE-2021-33338 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2021-33338?
CVE-2021-33338 affects Liferay Portal versions 7.1.0 through 7.3.2 and Liferay DXP versions 7.1 before fix pack 19 and 7.2 before fix pack 6.
What is the impact of CVE-2021-33338?
CVE-2021-33338 allows man-in-the-middle attackers to conduct Cross-Site Request Forgery (CSRF) attacks by obtaining the CSRF token from the exposed p_auth parameter in URLs.
How can I fix CVE-2021-33338?
To fix CVE-2021-33338, you should apply the relevant fix packs for Liferay DXP or Liferay Portal as mentioned in the provided references.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/liferay
- canonical/liferay dxp
- version/liferay dxp/7.1
- version/liferay dxp/7.1-fix_pack_1
- version/liferay dxp/7.1-fix_pack_10
- version/liferay dxp/7.1-fix_pack_11
- version/liferay dxp/7.1-fix_pack_12
- version/liferay dxp/7.1-fix_pack_13
- version/liferay dxp/7.1-fix_pack_14
- version/liferay dxp/7.1-fix_pack_15
- version/liferay dxp/7.1-fix_pack_16
- version/liferay dxp/7.1-fix_pack_17
- version/liferay dxp/7.1-fix_pack_18
- version/liferay dxp/7.1-fix_pack_2
- version/liferay dxp/7.1-fix_pack_3
- version/liferay dxp/7.1-fix_pack_4
- version/liferay dxp/7.1-fix_pack_5
- version/liferay dxp/7.1-fix_pack_6
- version/liferay dxp/7.1-fix_pack_7
- version/liferay dxp/7.1-fix_pack_8
- version/liferay dxp/7.1-fix_pack_9
- version/liferay dxp/7.2
- version/liferay dxp/7.2-fix_pack_1
- version/liferay dxp/7.2-fix_pack_2
- version/liferay dxp/7.2-fix_pack_3
- version/liferay dxp/7.2-fix_pack_4
- version/liferay dxp/7.2-fix_pack_5
- canonical/liferay liferay portal
- version/liferay liferay portal/7.1.0
- version/liferay liferay portal/7.3.2