CVE-2021-38268
mediumpriority · track · 26OT risk · elevatedEPSS 0.008 · 56 %ileEUUSEPSS · scored 2026-10-27
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (14)
Products and version ranges known to be affected.
- liferay digital experience platform< 7.2.1nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- liferay digital experience platform= 7.2nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- liferay digital experience platform= 7.3nvdUScpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
- Maven com.liferay.portal:release.dxp.bom7.0.0 → 7.0.10.fp101osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.1.0 → 7.1.10.fp21osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.2.0 → 7.2.10.fp10osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay.portal:release.dxp.bom7.3.0 → 7.3.10.fp2osvUSpkg:maven/com.liferay.portal/release.dxp.bom
- Maven com.liferay:com.liferay.dynamic.data.mapping.service< 6.0.0osvUSpkg:maven/com.liferay/com.liferay.dynamic.data.mapping.service
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-f855-2rvm-5j7hLiferay Portal and Liferay DXP has incorrect default permissions for site members2022-03-03ghsa · osvUS
The Dynamic Data Mapping module before 4.0.39 from Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- BIT-liferay-2021-382682024-01-31vendor · osvUS
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://liferay.comcnnvd
- https://cxsecurity.com/cveshow/CVE-2021-38268/cnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultcnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=cnnvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultenisa_euvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPenisa_euvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-defaultVendor Advisorynvd
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan