What is CVE-2023-33950?

CVE-2023-33950 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Inefficient Regular Expression Complexity. CVSS score: 6.5/10. Published 2023-05-24.

How severe is CVE-2023-33950?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Liferay Digital Experience Platform

CVE-2023-33950

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

Vulnerability class: ReDoS (Regular Expression Denial of Service)

EPSS: 0.009 (56.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Liferay Digital_experience_platform — versions 7.4
Liferay Dxp — versions 7.4.13.u48
Liferay Liferay_portal
Liferay Portal — versions 7.4.3.48

Weakness classification (CWE)

CWE-1333 — Inefficient Regular Expression Complexity

References

security@liferay.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-33950?: CVE-2023-33950 is a medium-severity vulnerability in Liferay Digital Experience Platform, classified under Inefficient Regular Expression Complexity. CVSS score: 6.5/10. Published 2023-05-24.
How severe is CVE-2023-33950?: Medium severity. CVSS v3 base score is 6.5 out of 10.