GitHub Advisoryadvisory · Maven

GHSA-g9mr-9xfc-4gf7 Insecure Default Initialization In Liferay Portal

MEDIUM Published 2023-05-24 Modified 2023-05-24 Official page ↗
Aliases
CVE-2023-33949
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1188
Reviewed
2023-05-24

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.0.0, < 7.3.1 → fixed in 7.3.1

Description

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.

Related

Alias · CVE (1)

  • CVE-2023-33949 In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References