cve.bz

CVE-2024-8980

6.1 mediumEPSS 0.2%

Medium (6.1) in liferay. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.4.3.102-GA102.

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE
CWE-352
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.portal.bom>=7.0.0-a1 <7.4.3.102-GA1027.4.3.102-GA102
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=2023.Q3.1 <2023.Q3.52023.Q3.5
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=7.0.0-GA <=7.0.10.fp102no fix published
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=7.1.0-GA <=7.1.10.fp28no fix published
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=7.2.0.GA <=7.2.10.fp20no fix published
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=7.3.0-GA <7.3.10.u367.3.10.u36
GHSA-chj2-4vg7-hhg3Mavencom.liferay.portal:release.dxp.bom>=7.4.0-GA <=7.4.13.u92no fix published

References

Check your stackJSON