CVE-2023-33948
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
| Software | From | Fixed in |
|---|---|---|
com.liferay.portal / release.portal.bom
|
7.4.3.67 | 7.4.3.67.x |
|
com.liferay.portal / release.portal.bom
|
7.4.3.67 | 7.4.3.68 |
| liferay / liferay_portal | 7.4.3.67 | 7.4.3.67.x |
| liferay / digital_experience_platform | 7.4-update67 | 7.4-update67.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime