{"id":"BIT-liferay-2021-38268","details":"The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.","aliases":["CVE-2021-38268","GHSA-f855-2rvm-5j7h"],"modified":"2025-07-14T22:26:58.379433Z","published":"2024-01-31T15:21:44.280Z","database_specific":{"cpes":["cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_1:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_2:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_3:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_4:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_5:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_6:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_7:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_8:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_9:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"WEB","url":"http://liferay.com"},{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default"},{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default?_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_assetEntryId=120882524&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_HbL5mxmVrnXW_redirect=https%3A%2F%2Fportal.liferay.dev%3A443%2Flearn%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetP"}],"affected":[{"package":{"name":"liferay","ecosystem":"Bitnami","purl":"pkg:bitnami/liferay"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.2.1"}]},{"type":"SEMVER","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"}]},{"type":"SEMVER","events":[{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.3-fix.0"},{"last_affected":"7.3-fix.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/liferay/BIT-liferay-2021-38268.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}],"schema_version":"1.7.3"}