CVE-2023-33943: 
Java vulnerability analysis and mitigation

A Cross-site scripting (XSS) vulnerability was discovered in the Account module of Liferay Portal versions 7.4.3.21 through 7.4.3.62 and Liferay DXP 7.4 updates 21 through 62. The vulnerability was assigned CVE-2023-33943 and was publicly disclosed on May 24, 2023 (CVE Details).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality (C:L) and integrity (I:L) impacts, and no availability impact (A:N) (NVD).

The vulnerability allows remote attackers to inject arbitrary web script or HTML through four different user profile fields: First Name, Middle Name, Last Name, and Job Title. This could potentially lead to the execution of malicious scripts in users' browsers, compromising their session security and potentially exposing sensitive information (Liferay Advisory).

The vulnerability has been patched in Liferay DXP 7.4 update 63 and Liferay Portal 7.4.3.63. Users are advised to upgrade to these versions or later to mitigate the risk (Liferay Advisory).