CVE-2021-38268

MEDIUM

Liferay Portal/DXP <7.4 - Privilege Escalation

Title source: llm

Description

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_misc

http://liferay.com

Vendor Advisory x_refsource_misc

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default

Patch, Vendor Advisory x_refsource_misc

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP

Scores

CVSS v3 6.5

EPSS 0.0012

EPSS Percentile 30.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-276

Status published

Products (6)

com.liferay/com.liferay.dynamic.data.mapping.service 0 - 6.0.0Maven

com.liferay.portal/release.dxp.bom 7.0.0 - 7.0.10.fp101Maven

liferay/digital_experience_platform 7.2 fix_pack_1 (9 CPE variants)

liferay/digital_experience_platform 7.3 (2 CPE variants)

liferay/digital_experience_platform < 7.2.1

liferay/liferay_portal 7.0.0 - 7.3.7

Published Mar 02, 2022

Tracked Since Feb 18, 2026