What is CVE-2023-33945?

CVE-2023-33945 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under SQL Injection. CVSS score: 6.4/10. Published 2023-05-24.

How severe is CVE-2023-33945?

Medium severity. CVSS v3 base score is 6.4 out of 10.

SQL Injection in Liferay Digital Experience Platform

CVE-2023-33945

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.

Vulnerability class: SQL Injection

EPSS: 0.005 (42.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Liferay Digital_experience_platform — versions 7.3, 7.4
Liferay Dxp — versions 7.3.10, 7.4.13
Liferay Liferay_portal
Liferay Portal — versions 7.3.1

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security@liferay.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-33945?: CVE-2023-33945 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under SQL Injection. CVSS score: 6.4/10. Published 2023-05-24.
How severe is CVE-2023-33945?: Medium severity. CVSS v3 base score is 6.4 out of 10.