CVE-2021-38268: Medium severity Liferay Digital Experience Platform vulnerability

Published Mar 2, 2022
·
Updated

The Dynamic Data Mapping module before 4.0.39 from Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

Other sources

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

— MITRE

Affected Software

18 affected componentsFixes available
Liferay Digital Experience Platform<7.2.1
Liferay Digital Experience Platform=7.2-fix_pack_1
Liferay Digital Experience Platform=7.2-fix_pack_2
Liferay Digital Experience Platform=7.2-fix_pack_3
Liferay Digital Experience Platform=7.2-fix_pack_4
Liferay Digital Experience Platform=7.2-fix_pack_5
Liferay Digital Experience Platform=7.2-fix_pack_6
Liferay Digital Experience Platform=7.2-fix_pack_7
Liferay Digital Experience Platform=7.2-fix_pack_8
Liferay Digital Experience Platform=7.2-fix_pack_9
Liferay Digital Experience Platform=7.3
Liferay Digital Experience Platform=7.3-fix_pack_1
Liferay Liferay Portal>=7.0.0<7.3.7
maven/com.liferay.portal:release.dxp.bom>=7.3.0<7.3.10.fp2
7.3.10.fp2
maven/com.liferay.portal:release.dxp.bom>=7.2.0<7.2.10.fp10
7.2.10.fp10
maven/com.liferay.portal:release.dxp.bom>=7.1.0<7.1.10.fp21
7.1.10.fp21
maven/com.liferay.portal:release.dxp.bom>=7.0.0<7.0.10.fp101
7.0.10.fp101
maven/com.liferay:com.liferay.dynamic.data.mapping.service<6.0.0
6.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.

    Fixed in 7.3.10.fp2
  2. Upgrade

    Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.

    Fixed in 7.2.10.fp10
  3. Upgrade

    Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.

    Fixed in 7.1.10.fp21
  4. Upgrade

    Upgrade maven/com.liferay.portal:release.dxp.bom to a version that resolves this vulnerability.

    Fixed in 7.0.10.fp101
  5. Upgrade

    Upgrade maven/com.liferay:com.liferay.dynamic.data.mapping.service to a version that resolves this vulnerability.

    Fixed in 6.0.0
  6. Upgrade

    Upgrade Liferay Portal Dynamic Data Mapping (DDM) to a version that resolves this vulnerability.

    Fixed in 4.0.39
  7. Upgrade

    Upgrade Liferay DXP 7.0 to a version that resolves this vulnerability.

    Patch fix pack 101
  8. Upgrade

    Upgrade Liferay DXP 7.1 to a version that resolves this vulnerability.

    Patch fix pack 21
  9. Upgrade

    Upgrade Liferay DXP 7.2 to a version that resolves this vulnerability.

    Patch fix pack 10
  10. Upgrade

    Upgrade Liferay DXP 7.3 to a version that resolves this vulnerability.

    Patch fix pack 2

Event History

Mar 2, 2022
CVE Published
via MITRE·06:45 PM
Data Sourced
via MITRE·06:45 PM
Description
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 3, 2022
Advisory Published
via GitHub·12:00 AM
Data Sourced
via GitHub·12:00 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is CVE-2021-38268?

CVE-2021-38268 is a vulnerability in Liferay Portal and Liferay DXP that allows remote authenticated users with site member permissions to add new forms by default.

2

What is the severity of CVE-2021-38268?

CVE-2021-38268 has a severity level of medium (CVSS score of 6.5).

3

Which versions of Liferay Portal and Liferay DXP are affected by CVE-2021-38268?

CVE-2021-38268 affects Liferay Portal versions 7.0.0 through 7.3.6, and Liferay DXP versions 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10, and 7.3 before fix pack 2.

4

How can remote authenticated users exploit CVE-2021-38268?

Remote authenticated users with site member permissions can exploit CVE-2021-38268 by adding new forms by default.

5

Where can I find more information about CVE-2021-38268?

You can find more information about CVE-2021-38268 on the Liferay website and the Liferay Developer Portal.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203