nvd-json-data-feeds/CVE-2021/CVE-2021-333xx/CVE-2021-33330.json

{
  "id": "CVE-2021-33330",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-08-03T19:15:08.853",
  "lastModified": "2021-08-11T14:31:21.703",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user\u2019s email address and current CSRF token."
    },
    {
      "lang": "es",
      "value": "Liferay Portal versiones 7.2.0 hasta 7.3.2, y Liferay DXP versiones 7.2 anteriores a fix pack 9, permite el acceso a recursos protegidos por Cross-origin resource sharing (CORS) si el usuario s\u00f3lo es autenticado usando la autenticaci\u00f3n de sesi\u00f3n del portal, lo que permite a atacantes remotos obtener informaci\u00f3n confidencial, incluyendo la direcci\u00f3n de correo electr\u00f3nico del usuario objetivo y el token de tipo CSRF actual"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "8CAAE1B7-982E-4D50-9651-DEEE6CD74EED"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_1:*:*:*:*:*:*",
              "matchCriteriaId": "AFCF99EC-3384-418D-A419-B9DB607BE371"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_2:*:*:*:*:*:*",
              "matchCriteriaId": "31E05134-A0C5-4937-A228-7D0884276B67"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_3:*:*:*:*:*:*",
              "matchCriteriaId": "3F06C4AD-FD20-4345-8386-0895312F0A00"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_4:*:*:*:*:*:*",
              "matchCriteriaId": "98CC25E2-EC3D-43A2-8D03-06F0E804EA63"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_5:*:*:*:*:*:*",
              "matchCriteriaId": "30933C36-C710-488F-9601-EE1BB749C58A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_6:*:*:*:*:*:*",
              "matchCriteriaId": "41E94372-A1AE-48B1-82DC-08B7B616473F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_7:*:*:*:*:*:*",
              "matchCriteriaId": "51FBC8E0-34F8-475C-A1A8-571791CA05F9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:dxp:7.2:fix_pack_8:*:*:*:*:*:*",
              "matchCriteriaId": "1E73EAEA-FA88-46B9-B9D5-A41603957AD7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.2.0",
              "versionEndExcluding": "7.3.3",
              "matchCriteriaId": "46F556AC-F439-4A82-8A5C-DAE70647A2A4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://issues.liferay.com/browse/LPE-17127",
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720",
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}