Cross-Site Request Forgery Vulnerability in Liferay Portal and DXP Products
CVE-2024-26273

8.8HIGH

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
22 October 2024

What is CVE-2024-26273?

A cross-site request forgery (CSRF) vulnerability has been identified in the content page editor features of Liferay Portal and Liferay DXP. This vulnerability allows remote attackers to execute a range of harmful actions including changing user passwords, shutting down the server, running arbitrary code in the scripting console, and gaining unauthorized administrative control via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter. Multiple affected versions include Liferay Portal 7.4.0 through 7.4.3.103 and various iterations of Liferay DXP 2023 and 2023.Q3. This risk highlights the need for users to apply necessary patches and mitigate potential exploits.

Affected Version(s)

DXP 7.3.10-u29 <= 7.3.10-u35

DXP 7.4.13 <= 7.4.13-u92

DXP 2023.Q3.1 <= 2023.Q3.5

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.