What is GHSA-fxpf-jr2q-vpvv?

GHSA-fxpf-jr2q-vpvv is a security advisory published by GitHub Security Advisories with High severity. Liferay Portal and Liferay DXP autosaves form data for other users to see

Which CVE IDs does GHSA-fxpf-jr2q-vpvv cover?

GHSA-fxpf-jr2q-vpvv covers the following CVE IDs: CVE-2021-33323. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fxpf-jr2q-vpvv?

GHSA-fxpf-jr2q-vpvv has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-fxpf-jr2q-vpvv?

GHSA-fxpf-jr2q-vpvv affects 3 products, including: maven/com.liferay:com.liferay.dynamic.data.mapping.form.web:\u003c 3.0.23; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.1.0, \u003c 7.1.10.fp19; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.2.0, \u003c 7.2.10.fp7.

GHSA-fxpf-jr2q-vpvvHighCVSS 7.5

Liferay Portal and Liferay DXP autosaves form data for other users to see

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

June 27, 2025

🔗 CVE IDs covered (1)

CVE-2021-33323 →

📋 Description

The Dynamic Data Mapping module in Dynamic Data Mapping Form Web before 3.0.23 in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

🎯 Affected products3

maven/com.liferay:com.liferay.dynamic.data.mapping.form.web:< 3.0.23
maven/com.liferay.portal:release.dxp.bom:>= 7.1.0, < 7.1.10.fp19
maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-33323
https://issues.liferay.com/browse/LPE-17049
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747107
https://github.com/advisories/GHSA-fxpf-jr2q-vpvv