Cross-Site Request Forgery Vulnerability in Liferay Portal and DXP Products
CVE-2024-26273
8.8HIGH
Key Information:
- Vendor
- Liferay
- Vendor
- CVE Published:
- 22 October 2024
Summary
A cross-site request forgery (CSRF) vulnerability has been identified in the content page editor features of Liferay Portal and Liferay DXP. This vulnerability allows remote attackers to execute a range of harmful actions including changing user passwords, shutting down the server, running arbitrary code in the scripting console, and gaining unauthorized administrative control via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter. Multiple affected versions include Liferay Portal 7.4.0 through 7.4.3.103 and various iterations of Liferay DXP 2023 and 2023.Q3. This risk highlights the need for users to apply necessary patches and mitigate potential exploits.
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published