CVE-2021-33333

Katalog CVE

CVSS 6.3 · Medium EPSS 0,85%

Kerentanan Incorrect Default Permissions pada liferay digital experience platform. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.

Rincian

Terbit di NVD

3 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 56,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 88 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://issues.liferay.com/browse/LPE-17032 patch · advisory vendor
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/1207... release notes · advisory vendor