Medium
Security advisory
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-33324
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:13 UTC · Revision 1
Source evidence
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.
osv:CVE-2021-33324
Complete source record
{
"id": "f9d5380d2adbb3221bec45f6f4114d65c364d4c4e4f79afff2af5e873c20bdad",
"url": "https://osv.dev/vulnerability/CVE-2021-33324",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-33324",
"summary": "The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.",
"evidence": "osv:CVE-2021-33324",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-33324",
"aliases": [
"CVE-2021-33324",
"GHSA-474f-cmx5-gm69"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/liferay/liferay-portal",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0515646c8f638f202d107469cc147172fc7685de"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"7.3.1-ga2",
"7.3.0-ga1",
"7.2.0-b3",
"7.2.0-b2",
"7.2.0-b1",
"7.2.0-a1",
"7.2.0-m2",
"7.1.0-b2",
"7.1.0-b1",
"7.1.0-a2",
"7.1.0-a1",
"7.1.0-m2",
"7.1.0-m1",
"sync-3.1.0-ga1",
"sync-3.0.10-ga2",
"sync-3.0.9-ga1",
"sync-3.0.8-b9",
"7.0.0-m5",
"sync-3.0.7-b8",
"sync-3.0.6-b7",
"sync-3.0.5-b6",
"sync-3.0.4-b5",
"sync-3.0.3-b4",
"sync-3.0.2-b3",
"sync-3.0.1-b2",
"sync-3.0.0-b1",
"7.0.0-m4",
"7.0.0-m3",
"7.0.0-m2",
"7.0.0-m1",
"6.2.0-b2",
"6.2.0-b1",
"6.2.0-m6",
"6.2.0-m5",
"6.2.0-m4",
"6.2.0-m3",
"6.2.0-m2",
"6.1.0-rc1",
"6.1.0-b4",
"6.1.0-b3",
"6.1.0-b2",
"6.1.0-b1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33324.json"
}
}
],
"modified": "2026-10-24T10:30:50.283991884Z",
"provider": "osv",
"references": [
"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747063",
"https://issues.liferay.com/browse/LPE-17001"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_10:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_11:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_12:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_13:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_14:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_15:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_16:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_17:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_18:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_19:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_1:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_2:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_3:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_4:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_5:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_6:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_7:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_8:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.1:fix_pack_9:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*",
"cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*"
],
"vendor_product": "liferay:digital_experience_platform",
"extracted_events": [
{
"range": [
{
"introduced": "7.1-NA"
},
{
"last_affected": "7.1-NA"
},
{
"introduced": "7.1-fix_pack_1"
},
{
"last_affected": "7.1-fix_pack_1"
},
{
"introduced": "7.1-fix_pack_10"
},
{
"last_affected": "7.1-fix_pack_10"
},
{
"introduced": "7.1-fix_pack_11"
},
{
"last_affected": "7.1-fix_pack_11"
},
{
"introduced": "7.1-fix_pack_12"
},
{
"last_affected": "7.1-fix_pack_12"
},
{
"introduced": "7.1-fix_pack_13"
},
{
"last_affected": "7.1-fix_pack_13"
},
{
"introduced": "7.1-fix_pack_14"
},
{
"last_affected": "7.1-fix_pack_14"
},
{
"introduced": "7.1-fix_pack_15"
},
{
"last_affected": "7.1-fix_pack_15"
},
{
"introduced": "7.1-fix_pack_16"
},
{
"last_affected": "7.1-fix_pack_16"
},
{
"introduced": "7.1-fix_pack_17"
},
{
"last_affected": "7.1-fix_pack_17"
},
{
"introduced": "7.1-fix_pack_18"
},
{
"last_affected": "7.1-fix_pack_18"
},
{
"introduced": "7.1-fix_pack_19"
},
{
"last_affected": "7.1-fix_pack_19"
},
{
"introduced": "7.1-fix_pack_2"
},
{
"last_affected": "7.1-fix_pack_2"
},
{
"introduced": "7.1-fix_pack_3"
},
{
"last_affected": "7.1-fix_pack_3"
},
{
"introduced": "7.1-fix_pack_4"
},
{
"last_affected": "7.1-fix_pack_4"
},
{
"introduced": "7.1-fix_pack_5"
},
{
"last_affected": "7.1-fix_pack_5"
},
{
"introduced": "7.1-fix_pack_6"
},
{
"last_affected": "7.1-fix_pack_6"
},
{
"introduced": "7.1-fix_pack_7"
},
{
"last_affected": "7.1-fix_pack_7"
},
{
"introduced": "7.1-fix_pack_8"
},
{
"last_affected": "7.1-fix_pack_8"
},
{
"introduced": "7.1-fix_pack_9"
},
{
"last_affected": "7.1-fix_pack_9"
},
{
"introduced": "7.2-NA"
},
{
"last_affected": "7.2-NA"
},
{
"introduced": "7.2-fix_pack_1"
},
{
"last_affected": "7.2-fix_pack_1"
},
{
"introduced": "7.2-fix_pack_2"
},
{
"last_affected": "7.2-fix_pack_2"
},
{
"introduced": "7.2-fix_pack_3"
},
{
"last_affected": "7.2-fix_pack_3"
},
{
"introduced": "7.2-fix_pack_4"
},
{
"last_affected": "7.2-fix_pack_4"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-33324",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437205,
"published_at": "2021-08-03T19:15:08.69+00:00"
}