CVE-2023-33947: Medium severity liferay digital experience platform vulnerability
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.liferay.portal:release.portal.bomto a version that resolves this vulnerability.Fixed in 7.4.3.61 - Upgrade
Upgrade
Liferay Portal Object moduleto a version that resolves this vulnerability.Fixed in 7.4.3.61
Event History
Frequently Asked Questions
What is CVE-2023-33947?
CVE-2023-33947 is a vulnerability in Liferay Portal and Liferay DXP that allows remote authenticated users in one virtual instance to view object definition from a second virtual instance.
What is the severity of CVE-2023-33947?
CVE-2023-33947 has a severity level of medium.
How does CVE-2023-33947 affect Liferay Portal and Liferay DXP?
CVE-2023-33947 affects Liferay Portal versions 7.4.3.4 through 7.4.3.60 and Liferay DXP versions 7.4 before update 61.
How can remote authenticated users exploit CVE-2023-33947?
Remote authenticated users can exploit CVE-2023-33947 by searching for object definitions and accessing them from a different virtual instance.
Is there a fix available for CVE-2023-33947?
Yes, a fix is available for CVE-2023-33947 in Liferay DXP update 61 and Liferay Portal 7.4.3.61.