medium4.3

CVE-2021-33327

Liferay Portal and Liferay DXP does not properly check user permission

Impact

The Portlet Configuration module before 4.0.13 in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`com.liferay:com.liferay.portlet.configuration.web`	< 4.0.13	4.0.13
maven	`com.liferay.portal:release.dxp.bom`	>= 7.0.10.fp93, < 7.0.10.fp95	7.0.10.fp95

Affected products

Vendor	Product	Affected versions
Liferay	Digital Experience Platform	Versions 7.0, 7.1, 7.2
Liferay	Liferay Portal	from 7.2.0 before 7.3.4

Weakness classification

CWE-276

References

NVD record
CVE.org record
GitHub advisory
https://issues.liferay.com/browse/LPE-17075
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840
https://github.com/advisories/GHSA-22wc-7wmm-v4cc
https://nvd.nist.gov/vuln/detail/CVE-2021-33327
https://github.com/liferay/liferay-portal/commit/44317eb5274d24bb91c43c91cd5c678392eb9eeb
https://github.com/liferay/liferay-portal/commit/9e1628110ca5f0b7b867e1f55e3886c92fc67ca1
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33327-unauthorized-users-can-view-the-guest-and-user-roles?p_r_p_assetEntryId=121611305&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611305%26p_r_p_resetCur%3Dfalse%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0