Lucene search

LiferayCVE-2023-33947

HistoryMay 24, 2023 - 4:15 p.m.

CVE-2023-33947

2023-05-2416:15:09

CWE-284

Liferay

web.nvd.nist.gov

cve-2023-33947

liferay portal

liferay dxp

object module

information security

vulnerability

remote authenticated users

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

Affected configurations

Nvd

Node

liferaydigital_experience_platformMatch7.4-

liferaydigital_experience_platformMatch7.4update1

liferaydigital_experience_platformMatch7.4update21

liferaydigital_experience_platformMatch7.4update34

liferaydigital_experience_platformMatch7.4update36

liferaydigital_experience_platformMatch7.4update41

liferaydigital_experience_platformMatch7.4update50

liferaydigital_experience_platformMatch7.4update52

liferayliferay_portalRange7.4.3.4–7.4.3.60

VendorProductVersionCPE
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
liferaydigital_experience_platform7.4cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:-::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update1::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update21::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update34::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update36::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update41::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update50::::::
liferay	digital_experience_platform	7.4	cpe:2.3:a:liferay:digital_experience_platform:7.4:update52::::::
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Portal",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.3.60",
        "status": "affected",
        "version": "7.4.3.4",
        "versionType": "maven"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "DXP",
    "vendor": "Liferay",
    "versions": [
      {
        "lessThanOrEqual": "7.4.13.u60",
        "status": "affected",
        "version": "7.4.13",
        "versionType": "maven"
      }
    ]
  }
]