CVE-2021-38268
Liferay Portal and Liferay DXP has incorrect default permissions for site members
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
CVE-2021-38268- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
CVE List No score
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
CVE-2021-38268- Updated
- 2026-11-02
EUVDEUVD-2021-24726 No score
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
EUVD-2021-24726- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f855-2rvm-5j7h
Liferay Portal and Liferay DXP has incorrect default permissions for site members
The Dynamic Data Mapping module before 4.0.39 from Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
GHSA-f855-2rvm-5j7h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
CVE-2021-38268- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-f855-2rvm-5j7h
Liferay Portal and Liferay DXP has incorrect default permissions for site members
The Dynamic Data Mapping module before 4.0.39 from Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
GHSA-f855-2rvm-5j7h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVBIT-liferay-2021-38268 No score
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
- Record
BIT-liferay-2021-38268- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay:com.liferay.dynamic.data.mapping.serviceMaven |
before 6.0.0 | 6.0.0 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp101 | 7.0.10.fp101 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp21 | 7.1.10.fp21 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp10 | 7.2.10.fp10 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.fp2 | 7.3.10.fp2 |
liferayBitnami |
before 7.2.1, 7.3.0 to 7.3.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.2-fix.0 to 7.2-fix.0, 7.3-fix.0 to 7.3-fix.0 | 7.2.1 |
com.liferay:com.liferay.dynamic.data.mapping.serviceMaven |
before 6.0.0, plus listed versions 1.0.02.0.02.0.12.0.22.1.0 Show 45 moreShow less2.1.12.1.102.1.112.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.162.2.172.2.182.2.192.2.22.2.202.2.212.2.222.2.232.2.242.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.122.3.132.3.142.3.152.3.16 |
6.0.0 |
com.liferay.portal:release.dxp.bomMaven |
7.0.0 up to 7.0.10.fp101, plus listed versions 7.0.10.fp1007.0.10.fp607.0.10.fp617.0.10.fp627.0.10.fp63 Show 39 moreShow less7.0.10.fp647.0.10.fp657.0.10.fp667.0.10.fp677.0.10.fp687.0.10.fp697.0.10.fp707.0.10.fp717.0.10.fp727.0.10.fp737.0.10.fp747.0.10.fp757.0.10.fp767.0.10.fp777.0.10.fp787.0.10.fp797.0.10.fp807.0.10.fp817.0.10.fp827.0.10.fp837.0.10.fp847.0.10.fp857.0.10.fp85-17.0.10.fp867.0.10.fp86-17.0.10.fp877.0.10.fp87-17.0.10.fp887.0.10.fp897.0.10.fp907.0.10.fp917.0.10.fp927.0.10.fp947.0.10.fp94-17.0.10.fp957.0.10.fp95-17.0.10.fp95-27.0.10.fp977.0.10.fp98 |
7.0.10.fp101 |
com.liferay.portal:release.dxp.bomMaven |
7.1.0 up to 7.1.10.fp21, plus listed versions 7.1.107.1.10.fp17.1.10.fp107.1.10.fp117.1.10.fp12 Show 16 moreShow less7.1.10.fp137.1.10.fp147.1.10.fp157.1.10.fp167.1.10.fp177.1.10.fp187.1.10.fp197.1.10.fp27.1.10.fp207.1.10.fp37.1.10.fp47.1.10.fp57.1.10.fp67.1.10.fp77.1.10.fp87.1.10.fp9 |
7.1.10.fp21 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp10, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp2 Show 7 moreShow less7.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp10 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.fp2, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp1 |
7.3.10.fp2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38268 is a medium vulnerability (CVSS 6.5) in Liferay Portal, published March 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in com.liferay:com.liferay.dynamic.data.mapping.service 6.0.0.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38268-site-member-can-add-new-forms-by-default
nvd.nist.gov/vuln/detail/CVE-2021-38268
github.com/liferay/liferay-portal/commit/16228425d7395b564f3c4cb5fae0c71c7228202b
liferay.atlassian.net/browse/LPE-17150
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38268-site-member-can-add-new-forms-by-default?p_r_p_assetEntryId=121611813&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611813%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
liferay.com
Left out here: 567 versions. The JSON record has them.