CVE-2021-33324

Vulnerability

The Layout module in Liferay Portal 7.1.0 through 7.3.1 and Liferay DXP 7.1 before fix pack 20 and 7.2 before fix pack 5 does not properly check permissions when viewing pages via the site's page administration interface. This allows remote authenticated users who lack view permission on a page to still view it. [1][3]

Exploitation

An attacker needs only a valid authenticated session on a Liferay instance. By navigating to the site's page administration, they can view pages that should be restricted. No special privileges or user interaction beyond authentication is required. [1][3]

Impact

Successful exploitation results in unauthorized disclosure of page content, violating confidentiality. The attacker gains the ability to view pages they are not permitted to see, potentially exposing sensitive information. The privilege level remains that of the authenticated user, but the scope of access is broader than intended. [1][3]

Mitigation

Liferay Portal 7.3 users should upgrade to 7.3 CE GA3 (7.3.2) or later. For Liferay Portal 7.2, a source patch is available for 7.2 GA2 (7.2.1). For Liferay Portal 7.1, upgrade to 7.2.1 and apply the latest patch. Liferay DXP 7.1 users should apply fix pack 20, and DXP 7.2 users fix pack 5. No workaround is mentioned. [3]