CVE-2023-33948: CVE-2023-33948 Unauthorized access to Document and Media files via Forms - Liferay

This website uses cookies to ensure you get the best experience. Learn More.

Accept

• Ask
• Blogs
• Download
• Feedback
• Help
• Learn
• Projects
• /dev/24
• Log In

Known Vulnerabilities

• Overview
• Reporting Security Issues
• Known Vulnerabilities
• Hall of Fame

Releases

• Liferay Portal 7.4

• Liferay Portal 7.3

• Liferay Portal 7.2

• Liferay Portal 7.1

• Liferay Portal 7.0

• Liferay Portal 6.2 CE

• Liferay Faces

• Liferay DXP 7.4

• Liferay DXP 7.3

• Liferay DXP 7.2

• LIferay DXP 7.1

• LIferay DXP 7.0

CVE-2023-33948 Unauthorized access to Document and Media files via Forms

Description

The Dynamic Data Mapping module in Liferay Portal and Liferay DXP does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

Severity

5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Version(s)

• Liferay DXP 7.4 update 67
• Liferay Portal 7.4.3.67

Fixed Version(s)

• Liferay DXP 7.4 update 68
• Liferay Portal 7.4.3.68

Publication date: Wed, 24 May 2023 07:00:00 +0000

Security advisories for Liferay’s enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.