CVE-2023-33946

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 24, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-339474.3The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by vir CVE-2023-339487.5The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can CVE-2023-339497.5In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email CVE-2023-33956.5All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files c CVE-2023-339507.5Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are CVE-2023-339515.3A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The i CVE-2023-339526.7A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due CVE-2023-339537.5gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in ex CVE-2023-339555.3Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This CVE-2023-339566.5Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insec CVE-2023-339575.7notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nu CVE-2023-339586.5notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nu