GitHub Advisoryadvisory · Maven

GHSA-22wc-7wmm-v4cc Liferay Portal and Liferay DXP does not properly check user permission

MEDIUM Published 2022-05-24 Modified 2025-06-27 Official page ↗
Aliases
CVE-2021-33327
Ecosystem
Maven
Packages
com.liferay:com.liferay.portlet.configuration.web, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2025-06-27

Affected packages

• Maven com.liferay:com.liferay.portlet.configuration.web: < 4.0.13 → fixed in 4.0.13 • Maven com.liferay.portal:release.dxp.bom: >= 7.0.10.fp93, < 7.0.10.fp95 → fixed in 7.0.10.fp95 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.10.fp18, < 7.1.10.fp19 → fixed in 7.1.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp8 → fixed in 7.2.10.fp8

Description

The Portlet Configuration module before 4.0.13 in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

Related

Alias · CVE (1)

  • CVE-2021-33327 The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References