What’s Vulnerable › Vulnerabilities

CVE-2021-33330

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-03 · updated 2026-06-17

Description

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Affected products

• Liferay Digital Experience Platform: 7.2, 7.2-fix_pack_1, 7.2-fix_pack_2, 7.2-fix_pack_3, 7.2-fix_pack_4, 7.2-fix_pack_5 (+3)
• Liferay Portal: from 7.2.0 before 7.3.3 — fixed in 7.3.3

How to fix

Upgrade to a fixed version: Liferay Portal 7.3.3. Check the vendor advisory for mitigations.

References

• https://issues.liferay.com/browse/LPE-17127
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720
• https://issues.liferay.com/browse/LPE-17127
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747720

Get alerted when CVE-2021-33330 or the next vulnerability affects your stack