Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

Remediation

References

CVE-2021-33323

Related Vulnerabilities

Magento Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2019-8235)

Internet Information Services Other Vulnerability (CVE-2011-5279)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-0361)

WordPress Plugin WordPress Backup and Migrate-Backup Guard Multiple Unspecified Vulnerabilities (1.1.32)

WordPress Plugin Shibboleth Cross-Site Scripting (1.7)

Severity

High

Classification

CVE-2021-33323 CWE-312 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities