PT-2023-24590 · Liferay · Liferay Dxp+1

Published 2023-05-24 · Updated 2024-01-31 · CVE-2023-33948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal version 7.4.3.67 Liferay DXP 7.4 update 67

Description The issue allows remote attackers to download any file from Document and Media via a crafted URL, due to the Dynamic Data Mapping module not limiting Document and Media files which can be downloaded from a Form.

Recommendations For Liferay Portal version 7.4.3.67, consider restricting access to the Dynamic Data Mapping module until a fix is available. For Liferay DXP 7.4 update 67, restrict access to the Dynamic Data Mapping module to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-LIFERAY-2023-33948

CVE-2023-33948

GHSA-W6F8-MXF5-4VF8

Affected Products

Liferay Dxp

Liferay Portal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-33948 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33948 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2023-33948 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w6f8-mxf5-4vf8 · Vendor Advisory
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/64699 · Telegram Post