medium
6.5
CWE
276
Advisory Published
Updated

CVE-2021-38268

First published: Wed Mar 02 2022(Updated: )

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Liferay Digital Experience Platform<7.2.1
Liferay Digital Experience Platform=7.2-fix_pack_1
Liferay Digital Experience Platform=7.2-fix_pack_2
Liferay Digital Experience Platform=7.2-fix_pack_3
Liferay Digital Experience Platform=7.2-fix_pack_4
Liferay Digital Experience Platform=7.2-fix_pack_5
Liferay Digital Experience Platform=7.2-fix_pack_6
Liferay Digital Experience Platform=7.2-fix_pack_7
Liferay Digital Experience Platform=7.2-fix_pack_8
Liferay Digital Experience Platform=7.2-fix_pack_9
Liferay Digital Experience Platform=7.3
Liferay Digital Experience Platform=7.3-fix_pack_1
Liferay Liferay Portal>=7.0.0<7.3.7

Remedy

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2021-38268?

    CVE-2021-38268 is a vulnerability in Liferay Portal and Liferay DXP that allows remote authenticated users with site member permissions to add new forms by default.

  • What is the severity of CVE-2021-38268?

    CVE-2021-38268 has a severity level of medium (CVSS score of 6.5).

  • Which versions of Liferay Portal and Liferay DXP are affected by CVE-2021-38268?

    CVE-2021-38268 affects Liferay Portal versions 7.0.0 through 7.3.6, and Liferay DXP versions 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 2.

  • How can remote authenticated users exploit CVE-2021-38268?

    Remote authenticated users with site member permissions can exploit CVE-2021-38268 by adding new forms by default.

  • Where can I find more information about CVE-2021-38268?

    You can find more information about CVE-2021-38268 on the Liferay website and the Liferay Developer Portal.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203