CVE-2024-8980

State: Published
Severity: 9.6 Critical
Published: Oct 22, 2024
Updated: Oct 22, 2024
Reserved: Sep 18, 2024

Description

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	Liferay

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
PortalLiferay	7.0.0 through 7.4.3.101Affected
DXPLiferay	6.2.0 through portal-173Affected 7.0.10 through de-102Affected 7.1.10 through dxp-28Affected 7.2.10 through dxp-20Affected 7.3.10 through 7.3.10-u35Affected 7.4.13 through 7.4.13-u92Affected 2023.Q3.1 through 2023.Q3.4Affected

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.