CVE-2023-33950: 
Java vulnerability analysis and mitigation

CVE-2023-33950 affects Pattern Redirects functionality in Liferay Portal versions 7.4.3.48 through 7.4.3.76 and Liferay DXP 7.4 updates 48 through 76. The vulnerability was discovered and disclosed on May 24, 2023, and was assigned by Liferay Inc. as the CNA (CVE Numbering Authority) (NVD, CVE).

The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity) and allows regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service) attacks to be used as patterns. The severity is rated as HIGH with a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) according to NVD, while Liferay Inc. rates it as MEDIUM with a score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

When exploited, this vulnerability allows remote attackers to consume an excessive amount of server resources through crafted request URLs, potentially leading to denial of service conditions (Liferay Advisory).

The vulnerability has been fixed in Liferay DXP 7.4 update 77 and Liferay Portal 7.4.3.77. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Liferay Advisory).