CVE-2023-33947 — Improper Access Control in DXP

CWE-284 — Improper Access Control4 documents4 sources
Severity
4.3MEDIUMNVD
CNA2.7
EPSS
0.2%
top 58.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay DXPLiferay PortalLiferay Portal+1 more
Timeline
PublishedMay 24

Description

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.3.4 — 7.4.3.60
▶NVDliferay/liferay_portal7.4.3.4 — 7.4.3.60
▶CVEListV5liferay/dxp7.4.13 — 7.4.13.u60

🔴Vulnerability Details

3
CVEList
CVE-2023-33947: The Object module in Liferay Portal 7↗2023-05-24
▶
OSV
Liferay portal has unauthorized access to object definition via search↗2023-05-24
▶
GHSA
Liferay portal has unauthorized access to object definition via search↗2023-05-24
▶
CVE-2023-33947 — Improper Access Control in Liferay DXP | cvebase