CVE-2023-33949CWE-1188

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which…

Medium · published May 24, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00818 · 56.7th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2023-05-24T16:01Z
EPSS history
Timeline
  • 24 MAY 16:01Z
    In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which…
    cvelistv5