CVE-2023-33941: 
Java vulnerability analysis and mitigation

Multiple cross-site scripting (XSS) vulnerabilities were discovered in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class affecting Liferay Portal versions 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 updates 41 through 52. The vulnerability was disclosed on May 24, 2023, and assigned CVE-2023-33941 (NVD, Liferay Advisory).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through two parameters: (1) code and (2) error in the OAuth2ProviderApplicationRedirect class. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows attackers to inject malicious web scripts or HTML content, potentially leading to the compromise of user sessions, theft of sensitive information, or manipulation of web content. The CVSS scoring indicates low confidentiality and integrity impacts, with no impact on availability (NVD).

The vulnerability requires no privileges (PR:N) and low attack complexity (AC:L), though it does require user interaction (UI:R). The attack vector is network-accessible (AV:N), making it exploitable remotely (NVD).

The vulnerability has been fixed in Liferay Portal version 7.4.3.53 and Liferay DXP 7.4 update 53. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).