GitHub Advisoryadvisory · Maven

GHSA-w6f8-mxf5-4vf8 Missing authorization in Liferay portal

HIGH Published 2023-05-24 Modified 2023-06-03 Official page ↗
Aliases
CVE-2023-33948
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Reviewed
2023-05-24

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.67, < 7.4.3.68 → fixed in 7.4.3.68

Description

The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2023-33948 The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References