Cross-Site Request Forgery Vulnerability in Liferay Portal and Liferay DXP
CVE-2021-29050

8.8HIGH

Key Information:

Vendor

Liferay
Vendor
CVE Published:
20 February 2024

What is CVE-2021-29050?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the terms of use page of Liferay Portal and Liferay DXP, allowing remote attackers to exploit this weakness. By enticing users to visit a malicious webpage, attackers can manipulate users into unknowingly accepting terms of service that they would not otherwise agree to. This vulnerability poses significant risks as it facilitates unauthorized actions on behalf of legitimate users, potentially leading to broader security issues.

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.