5.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-33949

GHSA ID

GHSA-g9mr-9xfc-4gf7

EPSS Score

0.39623%

CWE

CWE-1188

Published

5/24/2023

Updated

11/6/2023

KEV Status

Technology

Java

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-33949

CVE-2023-33949:
Insecure Default Initialization In Liferay Portal

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property company.security.strangers.verify should be set to true.

(GitHub Advisory)

5.3

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-33949

GHSA ID

GHSA-g9mr-9xfc-4gf7

EPSS Score

0.39623%

CWE

CWE-1188

Published

5/24/2023

Updated

11/6/2023

KEV Status

Technology

Java

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay.portal:release.portal.bom	maven	>= 7.0.0, < 7.3.1	7.3.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

In Li**r*y Port*l *.*.* *n* **rli*r, *n* Li**r*y *XP *.* *n* **rli*r t** ****ult *on*i*ur*tion *o*s not r*quir* us*rs to v*ri*y t**ir *m*il ***r*ss, w*i** *llows r*mot* *tt**k*rs to *r**t* ***ounts usin* **k* *m*il ***r*ss*s or *m*il ***r*ss*s w*i**

Reasoning

No *n*lysis *v*il**l*

5.3

Basic Information

Concerned about an active attack path?

CVE-2023-33949: Insecure Default Initialization In Liferay Portal

5.3

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

CVE-2023-33949:
Insecure Default Initialization In Liferay Portal

Vulnerability Intelligence
Miggo AI