Vulnerability Database
289,784
Total vulnerabilities in the database
CVE-2023-33948
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
| Software | From | Fixed in |
|---|---|---|
com.liferay.portal / release.portal.bom
|
7.4.3.67 | 7.4.3.67.x |
|
com.liferay.portal / release.portal.bom
|
7.4.3.67 | 7.4.3.68 |
| liferay / liferay_portal | 7.4.3.67 | 7.4.3.67.x |
| liferay / digital_experience_platform | 7.4-update67 | 7.4-update67.x |