CVE-2023-33949
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier, the default configuration does not require users to verify their email address, allowing remote attackers to create accounts using fake email addresses or addresses they do not control.
Risk Assessment
The lack of email verification poses a risk that unauthorized users may gain access to the system, potentially leading to abuse and security breaches.
Recommendation
It is recommended to set the portal property `company.security.strangers.verify` to true to enforce email address verification.
Original NVD description (English source)
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.