GitHub Advisoryadvisory · Maven

GHSA-5gh9-g62h-f35m Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers

HIGH Published 2022-05-24 Modified 2025-05-28 Official page ↗
Aliases
CVE-2021-33335
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-863
Reviewed
2025-05-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.0.3, < 7.3.5 → fixed in 7.3.5 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp20 → fixed in 7.1.10.fp20 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp9 → fixed in 7.2.10.fp9

Description

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Related

Alias · CVE (1)

  • CVE-2021-33335 Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-863 Incorrect Authorization weakness

References