CVE-2021-38268
mediumPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.008 · 56. PerzentilEUUSEPSS · bewertet 2026-10-27
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (14)
Betroffene Produkte und Versionsbereiche.
- liferay digital experience platform< 7.2.1nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- liferay digital experience platform= 7.2nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- liferay digital experience platform= 7.3nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- Maven com.liferay.portal:release.dxp.bom7.0.0 → 7.0.10.fp101osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.1.0 → 7.1.10.fp21osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.2.0 → 7.2.10.fp10osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.3.0 → 7.3.10.fp2osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay:com.liferay.dynamic.data.mapping.service< 6.0.0osvUSpkg:maven/com.liferay/com.liferay.dynamic.data.mapping.service
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-f855-2rvm-5j7hLiferay Portal and Liferay DXP has incorrect default permissions for site members2022-03-03ghsa · osvUS
The Dynamic Data Mapping module before 4.0.39 from Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- BIT-liferay-2021-382682024-01-31vendor · osvUS
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- http://liferay.comcnnvd
- https://cxsecurity.com/cveshow/CVE-2021-38268/cnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultcnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=cnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultenisa_euvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPenisa_euvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultVendor Advisorynvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPPatchVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan