CVE-2023-33946CWE-284

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual…

Low · published May 24, 2023

CVSS v3.1
2.7
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00608 · 48.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-05-24T15:28Z
EPSS history
Timeline
  • 24 MAY 15:28Z
    The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual…
    cvelistv5