Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02eHhjLTRqYzQtN2p2M84AArFR

Exposure of Resource to Wrong Sphere in Liferay Portal

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Permalink: https://github.com/advisories/GHSA-6xxc-4jc4-7jv3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02eHhjLTRqYzQtN2p2M84AArFR
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 9 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Identifiers: GHSA-6xxc-4jc4-7jv3, CVE-2021-33330
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-33330
• https://issues.liferay.com/browse/LPE-17127
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720
• https://github.com/advisories/GHSA-6xxc-4jc4-7jv3

Blast Radius: 6.5

Affected Packages