CVE-2021-33324
Estado: ModificadaMedia (4.3)—
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.88%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-276
Referencias
- https://issues.liferay.com/browse/LPE-17001
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063
- https://issues.liferay.com/browse/LPE-17001
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-33324",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-08-03T19:15:08.690",
"references": [
{
"url": "https://issues.liferay.com/browse/LPE-17001",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://issues.liferay.com/browse/LPE-17001",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration."
},
{
"lang": "es",
"value": "El módulo Layout en Liferay Portal versiones 7.1.0 hasta 7.3.1, y Liferay DXP versiones 7.1 anterior a fix pack 20, y versiones 7.2 anterior a fix pack 5, no comprueba apropiadamente los permisos de las páginas, que permite a usuarios autenticados remotos sin permiso de visualización de una página visualizar la página por medio de la administración de páginas de un sitio"
}
],
"lastModified": "2026-06-17T03:54:26.903",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27DF695E-B890-42C2-8941-5BB53154755F"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "072F6C59-3D86-48D1-A14E-477FFFA3B1D1"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE68B4A2-3459-4DBA-8BAC-E9AA9FA25264"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "680D7963-1393-4E86-A65F-D4463D532120"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D81E73DD-FD21-4082-A883-34422AE6C024"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6DD0451-98EA-4140-8294-77A14F063E2E"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE94E76B-8CC2-4E91-B7A3-EEBCC1358FF4"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "408BD438-E15C-422F-9612-C62A7387FC63"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A78C8B1C-39CB-4C27-B57C-0AF5E7EB50D9"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0AB19E97-BACE-4FCC-A53F-078D61A7A9E8"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D18ACD28-9182-435C-A30F-DF3BFE13C39A"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFE4CC72-C15A-40DE-AFF4-0B6B79BFB2BA"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "386F0E26-78DC-4D59-A20F-B41D0E59561B"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54576481-2AE9-4133-9EFA-B7FBDCA4427D"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E29CE810-76D5-4283-B102-70344B6C9506"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA869467-C560-4130-A180-86819F6A8673"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC0C94B7-31FB-4115-8EDE-62CC459B6663"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07DEAA71-53DA-4508-B7E6-924ABED49E66"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "467323F6-5CA7-42A0-9810-C6FA694CEC93"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32EFFD8A-1C0D-446B-AAD7-5D23D483D3D8"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7E68DF8-749B-4284-A7C9-929701A86B36"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CECAA19-8B7F-44C8-8059-6D4F2105E196"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68CBCEEB-7C28-4769-813F-3F01E33D2E08"
},
{
"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0CB4927-A361-4DFA-BDB8-A454EA2894AB"
},
{
"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81929C82-CE15-45AC-94D6-7B6906C9112E",
"versionEndExcluding": "7.3.2",
"versionStartIncluding": "7.1.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}