Exposure of Resource to Wrong Sphere in Liferay Portal

published 2021-08-03 5 y ago modified 2026-06-17 4 mo ago also GHSA-6xxc-4jc4-7jv3 , EUVD-2022-2883

cvss: 4.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Patch / fix

fixed in 2 links 1

maven com.liferay.portal:release.portal.bom 7.3.3
liferay liferay_portal 7.3.3

issues.liferay.com/browse/LPE-17127 advisory

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	com.liferay.portal:release.portal.bom	>=7.2.0, <7.3.3	7.3.3

Classification

Weakness

CWE-668 Exposure of Resource to Wrong Sphere

References

issues.liferay.com /browse/LPE-17127
web, patch, vendor-advisory
portal.liferay.dev /learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720
web, release-notes, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2021-33330
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary