Description

The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

Remediation

References

CVE-2023-33948

Related Vulnerabilities

Squid Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2213)

WordPress Plugin Add Link to Facebook Cross-Site Scripting (2.2.7)

osCommerce Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2020-27976)

WordPress Improper Input Validation Vulnerability (CVE-2016-9263)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-2197)

Severity

High

Classification

CVE-2023-33948 CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities