CVE-2021-33327: 
Java vulnerability analysis and mitigation

The vulnerability (CVE-2021-33327) affects the Portlet Configuration module in Liferay Portal versions 7.2.0 through 7.3.3, and Liferay DXP versions 7.0 fix pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8. The vulnerability was discovered and published on August 3, 2021, and involves improper user permission checks that allow remote authenticated users to view Guest and User roles even when 'Role Visibility' is enabled (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Under CVSS v2.0, it received a Base Score of 4.0 (MEDIUM) with the vector (AV:N/AC:L/Au:S/C:P/I:N/A:N). The vulnerability is classified under CWE-276 (Incorrect Default Permissions) (NVD).

The vulnerability allows remote authenticated users to bypass intended access restrictions and view Guest and User role information even when the 'Role Visibility' feature is enabled. This represents a breach of access control mechanisms and could potentially expose sensitive role-based information (NVD).

The vulnerability has been addressed in various versions of Liferay products. Users should upgrade to Liferay Portal versions after 7.3.3, or apply the appropriate fix packs: for DXP 7.0 after fix pack 94, DXP 7.1 after fix pack 18, or DXP 7.2 fix pack 8 or later (Liferay Issue).