netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4frg-rpx6-96qh
GHSA-5gh9-g62h-f35m
GHSA-7pxh-q6jw-6xj8
GHSA-9995-qvcg-x7g6
GHSA-fvg6-9r88-7w85
GHSA-g7xc-m762-wg8f
GHSA-4frg-rpx6-96qh
GHSA-5gh9-g62h-f35m
GHSA-7pxh-q6jw-6xj8
GHSA-9995-qvcg-x7g6
GHSA-fvg6-9r88-7w85
GHSA-g7xc-m762-wg8f
This commit is contained in:
advisory-database[bot]
2025-05-28 20:17:29 +00:00
parent 3eb1ff5a13
commit 89b6410a53
12 changed files with 631 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-4frg-rpx6-96qh/GHSA-4frg-rpx6-96qh.json
+106
View File
@@ -0,0 +1,106 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4frg-rpx6-96qh",
"modified": "2025-05-28T20:14:51Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33338"
],
"summary": "Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs",
"details": "The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.3.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.3.2"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp19"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33338"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17030"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:51Z",
"nvd_published_at": "2021-08-04T14:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-5gh9-g62h-f35m/GHSA-5gh9-g62h-f35m.json
+107
View File
@@ -0,0 +1,107 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gh9-g62h-f35m",
"modified": "2025-05-28T20:14:34Z",
"published": "2022-05-24T19:10:03Z",
"aliases": [
"CVE-2021-33335"
],
"summary": "Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers",
"details": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.3"
},
{
"fixed": "7.3.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.3.4"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp20"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33335"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17103"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220828222916/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:34Z",
"nvd_published_at": "2021-08-03T22:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-7pxh-q6jw-6xj8/GHSA-7pxh-q6jw-6xj8.json
+87
View File
@@ -0,0 +1,87 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pxh-q6jw-6xj8",
"modified": "2025-05-28T20:15:00Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33339"
],
"summary": "Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting",
"details": "Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.1"
},
{
"fixed": "7.3.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.3.4"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33339"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17102"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:15:00Z",
"nvd_published_at": "2021-08-04T13:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-9995-qvcg-x7g6/GHSA-9995-qvcg-x7g6.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9995-qvcg-x7g6",
"modified": "2025-05-28T20:14:04Z",
"published": "2022-05-24T19:09:41Z",
"aliases": [
"CVE-2021-33332"
],
"summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)",
"details": "Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.3.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp19"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33332"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17053"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:04Z",
"nvd_published_at": "2021-08-03T21:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-fvg6-9r88-7w85/GHSA-fvg6-9r88-7w85.json
+106
View File
@@ -0,0 +1,106 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvg6-9r88-7w85",
"modified": "2025-05-28T20:14:38Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33336"
],
"summary": "Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)",
"details": "Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.3.3"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp18"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.10.fp5"
},
{
"fixed": "7.2.10.fp7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33336"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17078"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:38Z",
"nvd_published_at": "2021-08-04T13:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-g7xc-m762-wg8f/GHSA-g7xc-m762-wg8f.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7xc-m762-wg8f",
"modified": "2025-05-28T20:14:10Z",
"published": "2022-05-24T19:09:41Z",
"aliases": [
"CVE-2021-33333"
],
"summary": "Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions",
"details": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.3.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.10.fp93"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp19"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33333"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17032"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
}
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:10Z",
"nvd_published_at": "2021-08-03T21:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-4frg-rpx6-96qh/GHSA-4frg-rpx6-96qh.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4frg-rpx6-96qh",
"modified": "2022-05-24T19:10:01Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33338"
],
"details": "The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33338"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17030"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748276"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-04T14:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5gh9-g62h-f35m/GHSA-5gh9-g62h-f35m.json
-40
View File
@@ -1,40 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gh9-g62h-f35m",
"modified": "2022-07-13T00:01:25Z",
"published": "2022-05-24T19:10:03Z",
"aliases": [
"CVE-2021-33335"
],
"details": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33335"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17103"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-03T22:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7pxh-q6jw-6xj8/GHSA-7pxh-q6jw-6xj8.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pxh-q6jw-6xj8",
"modified": "2022-05-24T19:10:01Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33339"
],
"details": "Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33339"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17102"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-04T13:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9995-qvcg-x7g6/GHSA-9995-qvcg-x7g6.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9995-qvcg-x7g6",
"modified": "2022-05-24T19:09:41Z",
"published": "2022-05-24T19:09:41Z",
"aliases": [
"CVE-2021-33332"
],
"details": "Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33332"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17053"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-03T21:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fvg6-9r88-7w85/GHSA-fvg6-9r88-7w85.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvg6-9r88-7w85",
"modified": "2022-05-24T19:10:01Z",
"published": "2022-05-24T19:10:01Z",
"aliases": [
"CVE-2021-33336"
],
"details": "Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPortlet_name parameter.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33336"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17078"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-04T13:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g7xc-m762-wg8f/GHSA-g7xc-m762-wg8f.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7xc-m762-wg8f",
"modified": "2022-05-24T19:09:41Z",
"published": "2022-05-24T19:09:41Z",
"aliases": [
"CVE-2021-33333"
],
"details": "The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33333"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17032"
},
{
"type": "WEB",
"url": "https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742"
}
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-03T21:15:00Z"
}
}