CVE-2021-33327

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-33327
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33327.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-33327
Aliases
Published
2021-08-03T19:15:08Z
Modified
2026-09-05T03:30:51Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*",
                "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.0-fix_pack_93"
                },
                {
                    "last_affected": "7.0-fix_pack_93"
                },
                {
                    "introduced": "7.0-fix_pack_94"
                },
                {
                    "last_affected": "7.0-fix_pack_94"
                },
                {
                    "introduced": "7.1-fix_pack_18"
                },
                {
                    "last_affected": "7.1-fix_pack_18"
                },
                {
                    "introduced": "7.2-NA"
                },
                {
                    "last_affected": "7.2-NA"
                },
                {
                    "introduced": "7.2-fix_pack_1"
                },
                {
                    "last_affected": "7.2-fix_pack_1"
                },
                {
                    "introduced": "7.2-fix_pack_2"
                },
                {
                    "last_affected": "7.2-fix_pack_2"
                },
                {
                    "introduced": "7.2-fix_pack_3"
                },
                {
                    "last_affected": "7.2-fix_pack_3"
                },
                {
                    "introduced": "7.2-fix_pack_4"
                },
                {
                    "last_affected": "7.2-fix_pack_4"
                },
                {
                    "introduced": "7.2-fix_pack_5"
                },
                {
                    "last_affected": "7.2-fix_pack_5"
                },
                {
                    "introduced": "7.2-fix_pack_6"
                },
                {
                    "last_affected": "7.2-fix_pack_6"
                },
                {
                    "introduced": "7.2-fix_pack_7"
                },
                {
                    "last_affected": "7.2-fix_pack_7"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "liferay:digital_experience_platform"
        }
    ]
}
References

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type
GIT
Repo
https://github.com/liferay/liferay-portal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d28f4266948e7b0eeb14c3e8d16b3d81e02e8bb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.2.0"
        },
        {
            "fixed": "7.3.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

6.*
6.1.0-b1
6.1.0-b2
6.1.0-b3
6.1.0-b4
6.1.0-rc1
6.2.0-b1
6.2.0-b2
6.2.0-m2
6.2.0-m3
6.2.0-m4
6.2.0-m5
6.2.0-m6
7.*
7.0.0-m1
7.0.0-m2
7.0.0-m3
7.0.0-m4
7.0.0-m5
7.1.0-a1
7.1.0-a2
7.1.0-b1
7.1.0-b2
7.1.0-m1
7.1.0-m2
7.2.0-a1
7.2.0-b1
7.2.0-b2
7.2.0-b3
7.2.0-m2
7.3.0-ga1
7.3.1-ga2
7.3.2-ga3
7.3.3-ga4
sync-3.*
sync-3.0.0-b1
sync-3.0.1-b2
sync-3.0.10-ga2
sync-3.0.2-b3
sync-3.0.3-b4
sync-3.0.4-b5
sync-3.0.5-b6
sync-3.0.6-b7
sync-3.0.7-b8
sync-3.0.8-b9
sync-3.0.9-ga1
sync-3.1.0-ga1
Other
test-fix-pack-base-7310

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33327.json"