« Volver al listado

CVE-2021-33330

Estado: ModificadaMedia (4.3)—

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Liferay — Digital Experience PlatformLiferay — Liferay Portal

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33330",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-03T19:15:08.853",
  "references": [
    {
      "url": "https://issues.liferay.com/browse/LPE-17127",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://issues.liferay.com/browse/LPE-17127",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token."
    },
    {
      "lang": "es",
      "value": "Liferay Portal versiones 7.2.0 hasta 7.3.2, y Liferay DXP versiones 7.2 anteriores a fix pack 9, permite el acceso a recursos protegidos por Cross-origin resource sharing (CORS) si el usuario sólo es autenticado usando la autenticación de sesión del portal, lo que permite a atacantes remotos obtener información confidencial, incluyendo la dirección de correo electrónico del usuario objetivo y el token de tipo CSRF actual"
    }
  ],
  "lastModified": "2026-06-17T03:54:27.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E68DF8-749B-4284-A7C9-929701A86B36"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CECAA19-8B7F-44C8-8059-6D4F2105E196"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68CBCEEB-7C28-4769-813F-3F01E33D2E08"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0CB4927-A361-4DFA-BDB8-A454EA2894AB"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2B771B7-D5CB-4778-A3A8-1005E4EE134C"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B9DB383-3791-4A43-BA4D-7695B203E736"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13F02D77-20E9-4F32-9752-511EB71E6704"
            },
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6353CC8F-A6D4-4A0C-8D68-290CD8DEB4F8"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46F556AC-F439-4A82-8A5C-DAE70647A2A4",
              "versionEndExcluding": "7.3.3",
              "versionStartIncluding": "7.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}