Lucene search

K
cve[email protected]CVE-2023-33947
HistoryMay 24, 2023 - 4:15 p.m.

CVE-2023-33947

2023-05-2416:15:09
CWE-284
web.nvd.nist.gov
39
cve-2023-33947
liferay portal
liferay dxp
object module
information security
vulnerability
remote authenticated users

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

Affected configurations

NVD
Node
liferaydigital_experience_platformMatch7.4-
OR
liferaydigital_experience_platformMatch7.4update1
OR
liferaydigital_experience_platformMatch7.4update21
OR
liferaydigital_experience_platformMatch7.4update34
OR
liferaydigital_experience_platformMatch7.4update36
OR
liferaydigital_experience_platformMatch7.4update41
OR
liferaydigital_experience_platformMatch7.4update50
OR
liferaydigital_experience_platformMatch7.4update52
OR
liferayliferay_portalRange7.4.3.47.4.3.60

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.60",
        "status": "affected",
        "version": "7.4.3.4",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u60",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      }
    ]
  }
]

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%