GitHub Advisoryadvisory · Maven

GHSA-fxpf-jr2q-vpvv Liferay Portal and Liferay DXP autosaves form data for other users to see

HIGH Published 2022-05-24 Modified 2025-06-27 Official page ↗
Aliases
CVE-2021-33323
Ecosystem
Maven
Packages
com.liferay:com.liferay.dynamic.data.mapping.form.web, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2025-06-27

Affected packages

• Maven com.liferay:com.liferay.dynamic.data.mapping.form.web: < 3.0.23 → fixed in 3.0.23 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp19 → fixed in 7.1.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp7 → fixed in 7.2.10.fp7

Description

The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

Related

Alias · CVE (1)

  • CVE-2021-33323 The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7,… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References