CVE-2023-33946: 
Java vulnerability analysis and mitigation

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 contains a vulnerability that fails to properly isolate objects in different virtual instances. This vulnerability was assigned CVE-2023-33946 and was disclosed on May 24, 2023. The affected software includes Liferay Portal versions 7.4.3.4 through 7.4.3.48 and Liferay DXP 7.4 versions prior to update 49 (Liferay Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and received a CVSS v3.1 base score of 2.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The vulnerability exists in the OAuth 2 scope administration page, where objects are not properly isolated between different virtual instances (NVD).

The vulnerability allows remote authenticated users in one virtual instance to view objects in a different virtual instance through the OAuth 2 scope administration page. The impact is limited to confidentiality breaches, with no reported integrity or availability impacts (Liferay Advisory).

The vulnerability has been fixed in Liferay Portal version 7.4.3.49 and Liferay DXP 7.4 update 49. Users are advised to upgrade to these versions or later to mitigate the vulnerability (Liferay Advisory).