CVE-2023-33948
First published: Wed May 24 2023(Updated: )
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Credit: security@liferay.com security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.liferay.portal:release.portal.bom | =7.4.3.67 | 7.4.3.68 |
| Liferay Liferay Portal | =7.4.3.67 | |
| Liferay Digital Experience Platform | =7.4-update67 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-33948?
The severity of CVE-2023-33948 is high.
What is the description of CVE-2023-33948?
CVE-2023-33948 allows remote attackers to download any file from Document and Media via a crafted URL.
Which software versions are affected by CVE-2023-33948?
Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 are affected by CVE-2023-33948.
How can I mitigate the vulnerability in CVE-2023-33948?
Update Liferay Portal to version 7.4.3.68 or later.
Where can I find more information about CVE-2023-33948?
You can find more information about CVE-2023-33948 at the following references: [Link 1](https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33948), [Link 2](https://nvd.nist.gov/vuln/detail/CVE-2023-33948), [Link 3](https://github.com/advisories/GHSA-w6f8-mxf5-4vf8).
- collector/github-advisory-latest
- alias/GHSA-w6f8-mxf5-4vf8
- alias/CVE-2023-33948
- collector/github-advisory
- collector/nvd-latest
- vendor/liferay
- vendor/liferay portal
- vendor/digital experience platform
- product/liferay portal
- canonical/liferay liferay portal
- product/digital experience platform
- canonical/liferay digital experience platform
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- package-manager/maven
- version/liferay liferay portal/7.4.3.67
- version/liferay digital experience platform/7.4-update67