Cross-Site Request Forgery Vulnerability in Liferay Portal and DXP
CVE-2024-8980

6.1MEDIUM

Key Information:

Vendor
Liferay
Status
Digital Experience Platform
Liferay Portal
Vendor
CVE Published:
22 October 2024

Summary

The Script Console in Liferay Portal and DXP fails to adequately mitigate Cross-Site Request Forgery (CSRF) risks. This issue allows malicious actors to craft URLs that exploit the vulnerability, potentially enabling them to execute arbitrary Groovy scripts remotely. As such, it poses a significant risk for systems running affected versions, which include Liferay Portal 7.0.0 through 7.4.3.101 and various iterations of Liferay DXP. Organizations using these products should prioritize applying relevant patches to safeguard against possible attacks.

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.