Description
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
Remediation
References
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33946
Related Vulnerabilities
CVE-2019-10326 Vulnerability in maven package io.jenkins.plugins:warnings-ng
CVE-2022-35924 Vulnerability in npm package next-auth
CVE-2018-11775 Vulnerability in maven package org.apache.activemq:activemq-client
CVE-2018-1000152 Vulnerability in maven package org.jenkins-ci.plugins:vsphere-cloud
CVE-2018-1999038 Vulnerability in maven package org.jenkins-ci.plugins:publish-over-cifs