CVE-2023-33948
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67 and Liferay DXP 7.4 update 67 does not limit Document and Media files that can be downloaded from a Form, allowing remote attackers to download any file via a crafted URL.
Risk Assessment
An attacker could gain access to sensitive files, potentially leading to data leaks and privacy violations for the organization.
Recommendation
It is recommended to update to the latest version of Liferay that implements restrictions on file downloads from forms.
Original NVD description (English source)
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.