CVE-2023-33942: 
Java vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in Liferay Portal 7.4.3.50 and Liferay DXP 7.4 update 50, specifically affecting the Web Content Display widget's article selector. The vulnerability was assigned CVE-2023-33942 and was published on May 24, 2023 (Liferay Advisory).

The vulnerability is classified as a stored XSS vulnerability (CWE-79) that allows attackers to inject malicious web script or HTML through the web content article's Title field in the Web Content Display widget. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (NVD).

The vulnerability can lead to the execution of arbitrary web scripts or HTML in the context of other users' browsers who view the affected content. This could result in theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users (CVE).

The vulnerability requires low privileges to exploit, meaning an attacker needs some form of authenticated access to the system. Additionally, user interaction is required for successful exploitation, as victims need to view the manipulated content (NVD).

The vulnerability has been fixed in Liferay DXP 7.4 update 51 and Liferay Portal 7.4.3.51. Users are advised to upgrade to these versions to mitigate the vulnerability (Liferay Advisory).