CVE-2021-38268
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members. This allows remote authenticated users with the site member role to add and duplicate forms via the UI or the API.
Risk Assessment
The organization is at risk of unauthorized form creation and duplication by users who should have limited privileges, potentially leading to data integrity issues and uncontrolled content proliferation.
Recommendation
Immediately upgrade Liferay Portal to version 7.3.7 or later, or for Liferay DXP apply the appropriate fix packs: 7.0 FP101, 7.1 FP21, 7.2 FP10, or 7.3 FP2.
Original NVD description (English source)
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.