CVE-2021-29052

2021-05-1712:15:07

Google

osv.dev

6.5 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.3%

JSON

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.

CPENameOperatorVersion
liferay-portaleq7.3.1-ga2
liferay-portaleqtest-fix-pack-base-7310
liferay-portaleq7.3.2-ga3
liferay-portaleq7.3.0-ga1
liferay-portaleq7.3.4-ga5
liferay-portaleq7.3.3-ga4
liferay-portaleq7.3.5-ga6

Name	Operator	Version
liferay-portal	eq	7.3.1-ga2
liferay-portal	eq	test-fix-pack-base-7310
liferay-portal	eq	7.3.2-ga3
liferay-portal	eq	7.3.0-ga1
liferay-portal	eq	7.3.4-ga5
liferay-portal	eq	7.3.3-ga4
liferay-portal	eq	7.3.5-ga6