CVE-2023-33939: 
Java vulnerability analysis and mitigation

CVE-2023-33939 is a Cross-site scripting (XSS) vulnerability discovered in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP versions 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9. The vulnerability was disclosed on May 24, 2023 (Liferay Advisory).

The vulnerability is classified as a Cross-site Scripting (CWE-79) issue that allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (NVD).

If exploited, this vulnerability allows attackers to inject malicious web scripts or HTML content through the facet label feature, potentially leading to unauthorized access to sensitive browser-based data or execution of arbitrary code in the context of the user's browser session (Liferay Advisory).

Affected users should upgrade to the following fixed versions: Liferay DXP 7.1 fix pack 27, DXP 7.2 fix pack 18, DXP 7.3 update 4, DXP 7.4 update 9, or Liferay Portal 7.4.3.13 (Liferay Advisory).