VULNERABILITY INTELLIGENCE

CVE-2023-33949

CVSS score5.3 MEDIUM
EPSS probability0.82%
CISA KEVNot currently listed
Published2023-05-24
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.

Weakness classification

  • security@liferay.com: CWE-1188
  • nvd@nist.gov: CWE-1188

Primary references