Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2023-33948

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-w6f8-mxf5-4vf8

Missing authorization in Liferay portal The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

gitlab/maven/com.liferay.portal/release.portal.bom/CVE-2023-33948

Missing authorization in Liferay portal The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.