CVE-2021-33335

EPSS 1.3%
Veröffentlicht 03.08.2021 22:15:09
Zuletzt bearbeitet 13.05.2025 18:17:51
Erkennungen
Login

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

NVD 30 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liferay ≫ Digital Experience Platform Version 7.1 Update -

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_10

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_11

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_12

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_13

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_14

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_15

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_16

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_17

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_18

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_19

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_8

Liferay ≫ Digital Experience Platform Version 7.1 Update fix_pack_9

Liferay ≫ Digital Experience Platform Version 7.2 Update -

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_1

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_2

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_3

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_4

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_5

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_6

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_7

Liferay ≫ Digital Experience Platform Version 7.2 Update fix_pack_8

Liferay ≫ Liferay Portal Version >= 7.0.3 < 7.3.5

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.3%	0.669

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://issues.liferay.com/browse/LPE-17103

Patch

Vendor Advisory

Issue Tracking

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-33335

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-33335

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-33335

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2021-33335