CVE-2021-33323

EPSS 1.03%
Veröffentlicht 03.08.2021 19:15:08
Zuletzt bearbeitet 13.05.2025 18:17:51
Erkennungen
Login

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 27 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version 7.1 Update -

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_17

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_18

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_6

Liferay ≫ Liferay Portal Version >= 7.1.0 < 7.3.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.03%	0.591

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

https://issues.liferay.com/browse/LPE-17049

Patch

Vendor Advisory

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-33323

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-33323

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-33323

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-33323