CVE-2021-33320: Liferay Flags Module Vulnerability Leading to Email Spam
Summary
CVE-2021-33320: Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate. Affects com.liferay:com.liferay.flags.taglib versions < 5.0.11. Fixed in 5.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Flags module is a component of Liferay Portal and Liferay DXP that allows users to flag content as inappropriate. This functionality is crucial for maintaining the integrity of content on the platform. However, the module has a vulnerability that allows authenticated users to abuse this feature, leading to potential spam issues for site administrators.
Vulnerability Detail
The vulnerability arises from the Flags module's failure to limit the rate at which content can be flagged as inappropriate. This oversight allows remote authenticated users to repeatedly flag content, resulting in excessive email notifications sent to site administrators. The vulnerability affects multiple versions of Liferay Portal and Liferay DXP, specifically versions prior to 5.0.11 for the Flags module, and various fix packs for Liferay DXP versions 7.0, 7.1, and 7.2. The potential ramifications include administrative overload and disruption of normal operations due to spam.
How To Fix
Minimum fixed version
5.0.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the flagging feature until the patch is applied. This can be done by modifying the configuration settings in the Liferay Portal administration panel.
Conclusion
The Liferay Flags module vulnerability (CVE-2021-33320) poses a significant risk by allowing authenticated users to spam site administrators with emails. It is crucial to update to the patched versions to mitigate this risk and maintain the integrity of your Liferay installation.
See every vulnerability recorded for com.liferay:com.liferay.flags.taglib →
FAQ
CVE-2021-33320 is a vulnerability in the Liferay Flags module that allows authenticated users to spam site administrators with excessive email notifications.
The vulnerability affects Liferay Portal versions prior to 5.0.11 and Liferay DXP versions 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The main consequence is the potential for site administrators to be overwhelmed with spam emails, which can disrupt normal operations and lead to administrative fatigue.
As a temporary measure, you can disable the flagging feature in the Liferay Portal administration panel to prevent users from flagging content until the vulnerability is patched.
