CVE-2021-33327 json
Liferay Portal and Liferay DXP does not properly check user permission
published 2021-08-03 5 y ago modified 2026-06-17 4 mo ago also GHSA-22wc-7wmm-v4cc , EUVD-2021-20036
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
Patch / fix
- maven com.liferay:com.liferay.portlet.configuration.web 4.0.13
- maven com.liferay.portal:release.dxp.bom 7.0.10.fp95, 7.1.10.fp19, 7.2.10.fp8
- liferay liferay_portal 7.3.4
Exploit prediction
0.86% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.portlet.configuration.web | <4.0.13 |
4.0.13 |
| maven | com.liferay.portal:release.dxp.bom | >=7.0.10.fp93, <7.0.10.fp95 >=7.1.10.fp18, <7.1.10.fp19 >=7.2.0, <7.2.10.fp8 |
7.0.10.fp95 7.1.10.fp19 7.2.10.fp8 |
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
issues.liferay.com
/browse/LPE-17075
web, patch, vendor-advisory
-
github.com
/liferay/liferay-portal/commit/44317eb5274d24bb91c43c91cd5c678392eb9eeb
web
-
github.com
/liferay/liferay-portal/commit/9e1628110ca5f0b7b867e1f55e3886c92fc67ca1
web
-
portal.liferay.dev
/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747840
release-notes, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-33327
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-33327-unauthorized-users-can-vi
web
Sources
- CVE List CVE-2021-33327
- GitHub Advisory GHSA-22wc-7wmm-v4cc
- NVD CVE-2021-33327
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.