CVE-2021-33330 Exposure of Resource to Wrong Sphere in Liferay Portal

Medium 4.3 Published 3 Aug 2021 Updated 3 Aug 2024

Remote attackers can access sensitive user data like email and CSRF tokens via CORS misconfiguration in Liferay Portal.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-33330?

CVE-2021-33330 is a medium-severity vulnerability in Liferay Digital Experience Platform, published on 3 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Which versions are affected by CVE-2021-33330?

2 open source packages ship an affected version, including com.liferay.portal:release.portal.bom. It affects 2 products.

Package	Affected	Fixed in
`com.liferay.portal:release.portal.bom` Maven	From `7.2.0`	`7.3.3`
`com.liferay.portal:release.portal.bom` Maven	From `7.2.0`	`7.3.3`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2021-33330?

Upgrade com.liferay.portal:release.portal.bom to 7.3.3 or later.

Is CVE-2021-33330 being exploited?

There is no known exploitation of CVE-2021-33330 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-6xxc-4jc4-7jv3.