PT-2023-24590 · Liferay · Liferay Dxp+1

CVE-2023-33948 · Publicado 2023-05-24 · Atualizado 2024-01-31

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal version 7.4.3.67 Liferay DXP 7.4 update 67

Description The issue allows remote attackers to download any file from Document and Media via a crafted URL, due to the Dynamic Data Mapping module not limiting Document and Media files which can be downloaded from a Form.

Recommendations For Liferay Portal version 7.4.3.67, consider restricting access to the Dynamic Data Mapping module until a fix is available. For Liferay DXP 7.4 update 67, restrict access to the Dynamic Data Mapping module to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BIT-LIFERAY-2023-33948

CVE-2023-33948

GHSA-W6F8-MXF5-4VF8

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 7

• https://github.com/liferay/liferay-portal · Nota
• https://t.me/cibsecurity/64699 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33948 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33948 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-liferay-2023-33948 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w6f8-mxf5-4vf8 · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948 · Aviso do Fabricante