CVE-2021-29052
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, allowing remote authenticated users to view DDMStructures via GET API calls.
Risk Assessment
The organization is at risk of unauthorized access to sensitive data structures (DDMStructures), potentially leading to information leakage or data confidentiality breaches.
Recommendation
Immediately update Liferay Portal to version 7.3.6 or later, and for Liferay DXP apply fix pack 1 or later.
Original NVD description (English source)
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.