[MAVEN:GHSA-6XXC-4JC4-7JV3] Exposure of Resource to Wrong Sphere in Liferay Portal

Severity Moderate

Affected Packages 1

Fixed Packages 1

CVEs 1

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Package	Affected Version
pkg:maven/com.liferay.portal/release.portal.bom	>= 7.2.0, < 7.3.3

Package	Fixed Version
pkg:maven/com.liferay.portal/release.portal.bom	= 7.3.3

ID: MAVEN:GHSA-6XXC-4JC4-7JV3
Severity: moderate
URL: https://github.com/advisories/GHSA-6xxc-4jc4-7jv3
Published: 2022-05-24T22:28:20
(2 years ago)
Modified: 2023-08-18T05:02:55
(13 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2021-33330
			https://issues.liferay.com/browse/LPE-17127
			https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720
			https://github.com/advisories/GHSA-6xxc-4jc4-7jv3

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/com.liferay.portal/release.portal.bom	com.liferay.portal	release.portal.bom	>= 7.2.0 < 7.3.3
Fixed	pkg:maven/com.liferay.portal/release.portal.bom	com.liferay.portal	release.portal.bom	= 7.3.3

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date