CVE-2021-33333 : Security Advisory and Response

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.

Understanding CVE-2021-33333

This CVE affects Liferay Portal and Liferay DXP versions due to improper user permission checks.

What is CVE-2021-33333?

The CVE-2021-33333 vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users to access and delete workflow submissions through specially crafted URLs.

The Impact of CVE-2021-33333

By exploiting this vulnerability, authenticated remote users can manipulate URLs to view and delete workflow submissions, potentially leading to unauthorized access and data loss.

Technical Details of CVE-2021-33333

This section covers specific technical details related to the CVE.

Vulnerability Description

The vulnerability arises from the lack of proper user permission validation in the Portal Workflow module, enabling attackers to access and delete workflow submissions.

Affected Systems and Versions

Liferay Portal 7.3.2 and earlier
Liferay DXP 7.0 before fix pack 93
Liferay DXP 7.1 before fix pack 19
Liferay DXP 7.2 before fix pack 6

Exploitation Mechanism

Remote authenticated users can exploit this vulnerability by crafting URLs to access and delete workflow submissions, bypassing the intended permission checks.

Mitigation and Prevention

To secure systems from CVE-2021-33333, follow the steps below.

Immediate Steps to Take

Apply the necessary security patches provided by Liferay for affected versions.
Monitor system logs for any suspicious activity related to workflow submissions.

Long-Term Security Practices

Regularly update Liferay Portal and Liferay DXP to the latest versions to ensure the adoption of security fixes.
Conduct regular security assessments and audits to identify and address potential vulnerabilities.

Patching and Updates

Stay informed about security updates and patches released by Liferay to protect the systems against known vulnerabilities.