CVE-2021-33335

EPSS 0.63%
Published 03.08.2021 22:15:09
Last modified 13.05.2025 18:17:51
Source cve@mitre.org
Teams watchlist Login
Open Login

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version7.1 Update-

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_1

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_10

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_11

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_12

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_13

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_14

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_15

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_16

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_17

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_18

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_19

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_2

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_3

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_4

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_5

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_6

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_7

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_8

Liferay ≫ Digital Experience Platform Version7.1 Updatefix_pack_9

Liferay ≫ Digital Experience Platform Version7.2 Update-

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_1

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_2

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_3

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_4

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_5

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_6

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_7

Liferay ≫ Digital Experience Platform Version7.2 Updatefix_pack_8

Liferay ≫ Liferay Portal Version >= 7.0.3 < 7.3.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.63%	0.679

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://issues.liferay.com/browse/LPE-17103

Patch

Vendor Advisory

Issue Tracking

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-33335

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-33335

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-33335

EUVD