« Volver al listado

CVE-2023-33949

Estado: AnalizadaAlta (7.5)—

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Liferay — Digital Experience PlatformLiferay — Liferay Portal

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-33949",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-33949",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-22T15:48:38.903885Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@liferay.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@liferay.com",
      "affectedData": [
        {
          "vendor": "Liferay",
          "product": "Portal",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "maven",
              "lessThanOrEqual": "7.3.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Liferay",
          "product": "DXP",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.3.10",
              "versionType": "maven"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-05-24T17:15:09.933",
  "references": [
    {
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@liferay.com"
    },
    {
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33949",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@liferay.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true."
    }
  ],
  "lastModified": "2026-06-17T06:02:34.937",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87C1F737-CC9C-4F58-90FF-1820273764BE",
              "versionEndIncluding": "7.2",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4E17D2C-F563-46F7-8441-37386D9AF4AF",
              "versionEndIncluding": "7.0.6",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59033BD5-FE75-479B-81F5-C93B54AA894C",
              "versionEndIncluding": "7.1.3",
              "versionStartIncluding": "7.1.0"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7CAF8FC-6334-48FD-A3E0-83EE307A5210",
              "versionEndIncluding": "7.2.1",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:a:liferay:liferay_portal:7.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91AE0729-1E78-4097-A400-694FDDE41F49"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@liferay.com"
}