Cross-Site Request Forgery Vulnerability in Liferay Portal and DXP
CVE-2024-8980
6.1MEDIUM
Key Information:
- Vendor
Liferay
- Vendor
- CVE Published:
- 22 October 2024
What is CVE-2024-8980?
The Script Console in Liferay Portal and DXP fails to adequately mitigate Cross-Site Request Forgery (CSRF) risks. This issue allows malicious actors to craft URLs that exploit the vulnerability, potentially enabling them to execute arbitrary Groovy scripts remotely. As such, it poses a significant risk for systems running affected versions, which include Liferay Portal 7.0.0 through 7.4.3.101 and various iterations of Liferay DXP. Organizations using these products should prioritize applying relevant patches to safeguard against possible attacks.