UpHeron
All vulnerabilities

Servers and applications

CVE-2023-33945

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must…

Severity
High 8.1
Published
24 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Liferay Portal / DXPServers and applications · cpe:a:liferay:digital_experience_platform
  • Version 7.4-update17
  • Version 7.4-update16
  • Version 7.4-update15
  • Version 7.4-update14
All 22 release lines
  • Version 7.3-update1
  • Version 7.3-update2
  • Version 7.3-update3
  • Version 7.3-update4
  • Version 7.3-update5
  • Version 7.4-update1
  • Version 7.4-update2
  • Version 7.4-update3
  • Version 7.4-update4
  • Version 7.4-update5
  • Version 7.4-update6
  • Version 7.4-update7
  • Version 7.4-update8
  • Version 7.4-update9
  • Version 7.4-update10
  • Version 7.4-update11
  • Version 7.4-update12
  • Version 7.4-update13
  • Version 7.4-update14
  • Version 7.4-update15
  • Version 7.4-update16
  • Version 7.4-update17
Liferay Portal / DXPServers and applications · cpe:a:liferay:liferay_portal
  • From 7.3.1 up to 7.3.7
  • From 7.4.0 up to 7.4.3.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-33945
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-33945