Description

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

Remediation

References

CVE-2021-33323

Related Vulnerabilities

XWikiplatform Insufficient UI Warning of Dangerous Operations Vulnerability (CVE-2025-49582)

WordPress Plugin WP Mailster Cross-Site Scripting (1.6.1)

WordPress Plugin BackWPup Multiple Local File Include Vulnerabilities (1.5.2)

TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2009-3631)

SharePoint CVE-2020-0972 Vulnerability (CVE-2020-0972)

Severity

High

Classification

CVE-2021-33323 CWE-312 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities