Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yODY4LWZmNDQtNDNxds4AAzdS

Liferay portal unauthorized access to objects via OAuth 2 scope

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

Permalink: https://github.com/advisories/GHSA-2868-ff44-43qv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODY4LWZmNDQtNDNxds4AAzdS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 6 months ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-2868-ff44-43qv, CVE-2023-33946
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-33946
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
• https://github.com/advisories/GHSA-2868-ff44-43qv

Blast Radius: 6.5

Affected Packages