Vulnerabilities > CVE-2021-33335 - Incorrect Authorization vulnerability in Liferay DXP and Liferay Portal

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

liferay

CWE-863

NVD

Published: 2021-08-03

Updated: 2024-11-21

Summary

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Vulnerable Configurations

Part	Description	Count
Application	Liferay Liferay DXP 7.2 Liferay DXP 7.1 Liferay Liferay Portal 7.0.3 Liferay Liferay Portal 7.0.3_Ga4 Liferay Liferay Portal 7.0.4 Liferay Liferay Portal 7.0.5 Liferay Liferay Portal 7.0.6 Liferay Liferay Portal 7.1 Liferay Liferay Portal 7.1.0 Liferay Liferay Portal 7.1.1 Liferay Liferay Portal 7.1.2 Liferay Liferay Portal 7.1.3 Liferay Liferay Portal 7.2 Liferay Liferay Portal 7.2.0 Liferay Liferay Portal 7.2.1 Liferay Liferay Portal 7.3 Liferay Liferay Portal 7.3.0 Liferay Liferay Portal 7.3.1 Liferay Liferay Portal 7.3.2 Liferay Liferay Portal 7.3.3 Liferay Liferay Portal 7.3.4	106

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References