CVE-2021-33330 CORS should not work with Portal Session authentication

Description

Liferay Portal 7.2.0 through 7.3.2 allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.

Severity

Severity 2

Fixed Version(s)

Acknowledgments

This issue was reported by Prajwal Khante

Publication Date: 

May 10, 2021

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!