CVE-2023-33946

State: Published
Severity: 2.7 Low
Published: May 24, 2023
Updated: Oct 22, 2024
Reserved: May 24, 2023

Description

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N	Liferay

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
PortalLiferay	7.4.3.4 through 7.4.3.48Affected
DXPLiferay	7.4.13 through 7.4.13.u48Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.