CVE-2021-33335: Liferay Digital Experience Platform

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.

Affected products

• Liferay Digital Experience Platform: version 7.1 only; version 7.2 only
• Liferay Liferay Portal: from 7.0.3, before 7.3.5 (fixed in 7.3.5)

Published 2021-08-03. Last modified 2026-06-17.