CVE-2023-33947: 
Java vulnerability analysis and mitigation

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 contains a security vulnerability identified as CVE-2023-33947. The vulnerability was discovered and disclosed on May 24, 2023. The issue affects the object definition search functionality across virtual instances, potentially exposing sensitive information between different virtual instance environments (NVD, Liferay Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and received a CVSS v3.1 base score of 4.3 (MEDIUM) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. However, Liferay Inc. assessed it with a lower CVSS score of 2.7 (LOW) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The vulnerability exists due to improper segmentation of object definitions in the search functionality (NVD).

The vulnerability allows remote authenticated users in one virtual instance to view object definitions from a second virtual instance by performing search operations. This results in a confidentiality breach where sensitive object definitions could be exposed across virtual instance boundaries (Liferay Advisory).

The vulnerability has been fixed in Liferay DXP 7.4 update 61 and Liferay Portal 7.4.3.61. Users running affected versions should upgrade to these patched versions to mitigate the vulnerability (Liferay Advisory).