PT-2023-24591 · Liferay · Liferay Dxp+1

Publicado 2023-05-24 · Atualizado 2026-01-09 · CVE-2023-33949

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 and earlier Liferay DXP versions 7.2 and earlier

Description The default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses they don't control. The issue can be addressed by setting the portal property company.security.strangers.verify to true.

Recommendations For Liferay Portal versions 7.3.0 and earlier, set the portal property company.security.strangers.verify to true. For Liferay DXP versions 7.2 and earlier, set the portal property company.security.strangers.verify to true.

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

BIT-LIFERAY-2023-33949

CVE-2023-33949

GHSA-G9MR-9XFC-4GF7

Produtos afetados

Liferay Dxp

Liferay Portal

Referências · 9

• https://github.com/liferay/liferay-portal · Nota
• https://osv.dev/vulnerability/CVE-2023-33949 · Aviso do Fabricante
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949 · Aviso do Fabricante
• https://t.me/cvenotify/51509 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33949 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-g9mr-9xfc-4gf7 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-liferay-2023-33949 · Aviso do Fabricante
• https://t.me/cibsecurity/64701 · Publicação no Telegram
• https://t.me/cveNotify/148162 · Publicação no Telegram