CVE-2023-33950

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liferay:digital_experience_platform:7.4:update48::::::
	cpe:2.3:a:liferay:digital_experience_platform:7.4:update76::::::
	cpe:2.3:a:liferay:liferay_portal::::::::

History

31 May 2023, 20:22

Type	Values Removed	Values Added
References	~~(MISC) https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950 -~~	(MISC) https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950 - Vendor Advisory
First Time		Liferay Liferay liferay Portal Liferay digital Experience Platform
CWE		CWE-1333
CPE		cpe:2.3:a:liferay:liferay_portal:::::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:::::: cpe:2.3:a:liferay:digital_experience_platform:7.4:update76::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

24 May 2023, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-05-24 17:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-33950

Mitre link : CVE-2023-33950

CVE.ORG link : CVE-2023-33950

JSON object : View

Products Affected

liferay

liferay_portal
digital_experience_platform

CWE

CWE-1333

{"id": "CVE-2023-33950", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@liferay.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-05-24T17:15:10.007", "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950", "tags": ["Vendor Advisory"], "source": "security@liferay.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1333"}]}, {"type": "Secondary", "source": "security@liferay.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs."}], "lastModified": "2023-05-31T20:22:30.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67F50AF8-7B0E-4D01-9EB2-C6625E9DACB6"}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E325115-EEBC-41F4-8606-45270DA40B98"}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7BD9AEF-1599-49B1-85E8-0B0DB56CE4C0", "versionEndIncluding": "7.4.3.76", "versionStartIncluding": "7.4.3.48"}], "operator": "OR"}]}], "sourceIdentifier": "security@liferay.com"}