CVE-2021-33338

Katalog CVE

CVSS 7.5 · High EPSS 0,42%

Kerentanan Cross-Site Request Forgery (CSRF) pada liferay digital experience platform, liferay portal. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.

Rincian

Terbit di NVD

4 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://issues.liferay.com/browse/LPE-17030 issue tracking · advisory vendor
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/1207... advisory vendor