CVE-2021-33328 : Security Advisory and Response

A Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal versions 7.0.0 through 7.3.4, and Liferay DXP versions 7.0 through 7.2 allows remote attackers to inject arbitrary web script or HTML. This CVE was published on August 3, 2021, by MITRE.

Understanding CVE-2021-33328

This section will delve into the details of the CVE-2021-33328 vulnerability, its impacts, technical aspects, and mitigation strategies.

What is CVE-2021-33328?

The CVE-2021-33328 is a Cross-site scripting (XSS) vulnerability found in Liferay Portal and Liferay DXP versions that enables malicious actors to inject arbitrary web script or HTML.

The Impact of CVE-2021-33328

The vulnerability in Liferay Portal and Liferay DXP versions allows remote attackers to execute malicious scripts, potentially leading to unauthorized access, data theft, or other undesirable consequences.

Technical Details of CVE-2021-33328

Let's explore the technical aspects of CVE-2021-33328 to understand how this vulnerability operates.

Vulnerability Description

The XSS vulnerability in the Asset module's edit vocabulary page of affected Liferay Portal and Liferay DXP versions enables attackers to insert malicious web scripts or HTML code via specific parameters, ultimately compromising the system's security.

Affected Systems and Versions

Liferay Portal versions 7.0.0 through 7.3.4 and Liferay DXP versions 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9 are susceptible to this XSS vulnerability.

Exploitation Mechanism

Malicious actors can exploit this vulnerability by injecting malicious web scripts or HTML through the _com_liferay_journal_web_portlet_JournalPortlet_name or _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

Mitigation and Prevention

Securing systems against CVE-2021-33328 is crucial to prevent potential security breaches and data compromise. Here are some key measures to mitigate the risk posed by this vulnerability.

Immediate Steps to Take

Update affected Liferay Portal and Liferay DXP versions to the latest fixed releases.
Implement web application firewalls to filter out malicious traffic that attempts XSS attacks.

Long-Term Security Practices

Regularly monitor and audit web applications for vulnerabilities.
Educate users and administrators about safe coding practices to prevent XSS attacks.

Patching and Updates

Stay informed about security updates from Liferay and apply patches promptly to protect your systems from known vulnerabilities.