Description
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
Related Vulnerabilities
CVE-2020-13957 Vulnerability in maven package org.apache.solr:solr-solrj
CVE-2016-8749 Vulnerability in maven package org.apache.camel:camel-jacksonxml
CVE-2014-9772 Vulnerability in npm package validator
CVE-2010-1330 Vulnerability in maven package org.jruby:jruby
CVE-2022-34780 Vulnerability in maven package com.xebialabs.ci:xlrelease-plugin