Read the docs
TI-2021-12801 Aliases CVE-2021-33327GHSA-22wc-7wmm-v4cc

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP…

Priority LOW 22CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.

Why it matters now

EPSS 0.00861 58th percentileScored 2026-11-07
Fix Fixed com.liferay:com.liferay.portlet.configuration.web (Maven): 4.0.13com.liferay.portal:release.dxp.bom (Maven): 7.0.10.fp95, 7.1.10.fp19, 7.2.10.fp8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.liferay:com.liferay.portlet.configuration.web (Maven)before 4.0.134.0.13Patch availableGHSA-22wc-7wmm-v4cc
—com.liferay.portal:release.dxp.bom (Maven)7.0.10.fp93 to before 7.0.10.fp957.0.10.fp95Patch availableGHSA-22wc-7wmm-v4cc
—com.liferay.portal:release.dxp.bom (Maven)7.1.10.fp18 to before 7.1.10.fp197.1.10.fp19Patch availableGHSA-22wc-7wmm-v4cc
—com.liferay.portal:release.dxp.bom (Maven)7.2.0 to before 7.2.10.fp87.2.10.fp8Patch availableGHSA-22wc-7wmm-v4cc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.liferay:com.liferay.portlet.configuration.web (Maven) Vendor— Affected before 4.0.13 Fixed in 4.0.13 Patch available GHSA-22wc-7wmm-v4cc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.0.10.fp93 to before 7.0.10.fp95 Fixed in 7.0.10.fp95 Patch available GHSA-22wc-7wmm-v4cc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.1.10.fp18 to before 7.1.10.fp19 Fixed in 7.1.10.fp19 Patch available GHSA-22wc-7wmm-v4cc
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp8 Fixed in 7.2.10.fp8 Patch available GHSA-22wc-7wmm-v4cc

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:*7.0 fix_pack_93VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:*7.0 fix_pack_94VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*7.1 fix_pack_18VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*7.2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*7.2 fix_pack_1VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*7.2 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*7.2 fix_pack_3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*7.2 fix_pack_4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*7.2 fix_pack_5VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*7.2 fix_pack_6VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_93:*:*:*:*:*:* Versions 7.0 fix_pack_93 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.0:fix_pack_94:*:*:*:*:*:* Versions 7.0 fix_pack_94 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:* Versions 7.1 fix_pack_18 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:* Versions 7.2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:* Versions 7.2 fix_pack_1 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:* Versions 7.2 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:* Versions 7.2 fix_pack_3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:* Versions 7.2 fix_pack_4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:* Versions 7.2 fix_pack_5 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:* Versions 7.2 fix_pack_6 Vulnerable ·Liferay
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*7.2 fix_pack_7VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.2.0 to before 7.3.4VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:* Versions 7.2 fix_pack_7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.2.0 to before 7.3.4 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-22wc-7wmm-v4cc com.liferay:com.liferay.portlet.configuration.web (Maven) Fixed in 4.0.13 Advisory →
  • Fix · GHSA-22wc-7wmm-v4cc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.0.10.fp95 Advisory →
  • Fix · GHSA-22wc-7wmm-v4cc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.1.10.fp19 Advisory →
  • Fix · GHSA-22wc-7wmm-v4cc com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33327
  2. 2026-10-03 Alias added: GHSA-22wc-7wmm-v4cc

References

Patch 1

Advisory 2

Other 4

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences