Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

Remediation

References

CVE-2021-33323

Related Vulnerabilities

Oracle Database Server CVE-2008-1818 Vulnerability (CVE-2008-1818)

MySQL CVE-2020-14873 Vulnerability (CVE-2020-14873)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce CSV Injection (5.5.2)

Oracle Database Server CVE-2020-2516 Vulnerability (CVE-2020-2516)

WordPress Plugin Advanced Custom Fields (ACF) 'acf_abspath' Parameter Remote File Include (3.5.1)

Severity

High

Classification

CVE-2021-33323 CWE-312 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities