GitHub Advisoryadvisory · Maven

GHSA-g7xc-m762-wg8f Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions

MEDIUM Published 2022-05-24 Modified 2025-05-28 Official page ↗
Aliases
CVE-2021-33333
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-276
Reviewed
2025-05-28

Affected packages

• Maven com.liferay.portal:release.portal.bom: <= 7.3.2 (no fix yet) • Maven com.liferay.portal:release.dxp.bom: < 7.0.10.fp93 → fixed in 7.0.10.fp93 • Maven com.liferay.portal:release.dxp.bom: >= 7.1.0, < 7.1.10.fp19 → fixed in 7.1.10.fp19 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp6 → fixed in 7.2.10.fp6

Description

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.

Related

Alias · CVE (1)

  • CVE-2021-33333 The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References