GHSA-2868-ff44-43qv

ghsaUSosv

Liferay portal unauthorized access to objects via OAuth 2 scope

view advisory published 2023-05-24Licence: CC-BY-4.0

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-33946US	medium4.3	0.61% (49th)	—	2023-05-24
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remot…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-33946ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan