Security readout for executives and security teams
Plain-English summary
CVE-2021-33335 lets certain logged-in Liferay users escalate privileges by editing the company administrator user. The issue matters because it can enable administrator account takeover, but only for users who already have permission to update or edit users.
Executive priority
Treat this as a priority fix for affected Liferay environments with delegated user administration. The business risk is administrator takeover from an already authenticated, privileged user path.
Technical view
The CVE affects Liferay Portal 7.0.3 through 7.3.4, Liferay DXP 7.1 before fix pack 20, and DXP 7.2 before fix pack 9. A remote authenticated user with user update/edit permission can take over a company administrator account by editing that administrator user.
Likely exposure
Exposure is most likely in Liferay deployments where delegated administrators, help desk staff, or custom roles can edit user accounts, especially if fix pack levels are below the named patched DXP releases.
Exploitation context
The source bundle does not identify public exploitation, exploit code, or CISA KEV listing. Evidence supports authenticated privilege escalation, not unauthenticated compromise or confirmed active exploitation.
Researcher notes
The CVE data lacks CVSS, CWE, and detailed patch notes in the provided bundle. Analysis is limited to the stated affected versions, required permissions, and named DXP fix packs.
Mitigation direction
- Apply Liferay DXP 7.1 fix pack 20 or later where applicable.
- Apply Liferay DXP 7.2 fix pack 9 or later where applicable.
- For Liferay Portal versions, check Liferay guidance for fixed release direction.
- Restrict user update/edit permissions to tightly trusted administrators.
- Review administrator account changes after patching or permission cleanup.
Validation and detection
- Inventory all Liferay Portal and DXP versions and fix pack levels.
- Identify roles with permission to update or edit user accounts.
- Confirm company administrator users cannot be modified by non-admin delegated roles.
- Review audit logs for unexpected changes to company administrator accounts.
- Verify remediation against Liferay advisory and issue references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Privilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-33335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906CVE reference · x_refsource_CONFIRM
- https://issues.liferay.com/browse/LPE-17103CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.