CVE-2023-33946 — Improper Access Control in DXP

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.3MEDIUMNVD
CNA2.7
EPSS
0.2%
top 58.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay DXPLiferay PortalLiferay Portal+1 more
Timeline
PublishedMay 24

Description

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.3.4 — 7.4.3.48
▶NVDliferay/liferay_portal7.4.3.4 — 7.4.3.48
▶CVEListV5liferay/dxp7.4.13 — 7.4.13.u48

🔴Vulnerability Details

3
GHSA
Liferay portal unauthorized access to objects via OAuth 2 scope↗2023-05-24
▶
OSV
Liferay portal unauthorized access to objects via OAuth 2 scope↗2023-05-24
▶
CVEList
CVE-2023-33946: The Object module in Liferay Portal 7↗2023-05-24
▶
CVE-2023-33946 — Improper Access Control in Liferay DXP | cvebase