CVE-2021-33335: 
Java vulnerability analysis and mitigation

A privilege escalation vulnerability was identified in Liferay Portal versions 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9. The vulnerability was assigned CVE-2021-33335 and was initially recorded on May 20, 2021 (CVE Details).

The vulnerability allows remote authenticated users with permission to update/edit users to escalate their privileges by taking over a company administrator user account through editing the company administrator user. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-863 (Incorrect Authorization) (NVD).

If exploited, this vulnerability allows attackers to gain unauthorized administrative access to the system by taking control of company administrator user accounts. This could lead to complete compromise of the affected Liferay Portal or DXP installation (NVD).

The vulnerability has been addressed in Liferay DXP 7.1 fix pack 20 and 7.2 fix pack 9. Users of affected versions should upgrade to these or later versions to mitigate the vulnerability (CVE Details).