Description

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.

Remediation

References

CVE-2023-33947

Related Vulnerabilities

ZenCart Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2021-3291)

Oracle JRE CVE-2019-2958 Vulnerability (CVE-2019-2958)

MySQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2004-0836)

WordPress Plugin Cookie Information-Free GDPR Consent Solution Cross-Site Scripting (1.5.5)

Django Improper Authentication Vulnerability (CVE-2021-44420)

Severity

Medium

Classification

CVE-2023-33947 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities