Read the docs
TI-2024-17356 Aliases CVE-2024-26271GHSA-6c4v-x9v2-rjm8

Cross-site request forgery in Liferay Portal

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.4.3.112com.liferay.portal:release.dxp.bom (Maven): 2023.Q4.3, 2023.Q3.6, 7.3u37 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LiferayPortal7.4.3.75 – 7.4.3.111—No fix listedCNA
LiferayDXP7.3.10-u32 – 7.3.10-u35; 7.4.13-u75 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.5; 2023.Q4.0 – 2023.Q4.2—No fix listedCNA
—com.liferay.portal:release.portal.bom (Maven)7.4.3.75 to before 7.4.3.1127.4.3.112Patch availableGHSA-6c4v-x9v2-rjm8
—com.liferay.portal:release.dxp.bom (Maven)2023.Q4.0 to before 2023.Q4.32023.Q4.3Patch availableGHSA-6c4v-x9v2-rjm8
—com.liferay.portal:release.dxp.bom (Maven)2023.Q3.1 to before 2023.Q3.62023.Q3.6Patch availableGHSA-6c4v-x9v2-rjm8
—com.liferay.portal:release.dxp.bom (Maven)7.3u32 to before 7.3u377.3u37Patch availableGHSA-6c4v-x9v2-rjm8
—com.liferay.portal:release.dxp.bom (Maven)7.4u75 to before 7.4u937.4u93Patch availableGHSA-6c4v-x9v2-rjm8
  • Portal VendorLiferay Affected 7.4.3.75 – 7.4.3.111 Fixed in — No fix listed CNA
  • DXP VendorLiferay Affected 7.3.10-u32 – 7.3.10-u35; 7.4.13-u75 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.5; 2023.Q4.0 – 2023.Q4.2 Fixed in — No fix listed CNA
  • com.liferay.portal:release.portal.bom (Maven) Vendor— Affected 7.4.3.75 to before 7.4.3.112 Fixed in 7.4.3.112 Patch available GHSA-6c4v-x9v2-rjm8
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 2023.Q4.0 to before 2023.Q4.3 Fixed in 2023.Q4.3 Patch available GHSA-6c4v-x9v2-rjm8
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 2023.Q3.1 to before 2023.Q3.6 Fixed in 2023.Q3.6 Patch available GHSA-6c4v-x9v2-rjm8
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3u32 to before 7.3u37 Fixed in 7.3u37 Patch available GHSA-6c4v-x9v2-rjm8
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.4u75 to before 7.4u93 Fixed in 7.4u93 Patch available GHSA-6c4v-x9v2-rjm8

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*2023.q3.1 to before 2023.q3.6; 2023.q4.0 to before 2023.q4.3VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*7.3 update32VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*7.3 update33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*7.3 update34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*7.3 update35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*7.4 update75VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*7.4 update76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*7.4 update77VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*7.4 update78VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*7.4 update79VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* Versions 2023.q3.1 to before 2023.q3.6; 2023.q4.0 to before 2023.q4.3 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:* Versions 7.3 update32 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:* Versions 7.3 update33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:* Versions 7.3 update34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:* Versions 7.3 update35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:* Versions 7.4 update75 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* Versions 7.4 update76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:* Versions 7.4 update77 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:* Versions 7.4 update78 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:* Versions 7.4 update79 Vulnerable ·Liferay
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*7.4 update80VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*7.4 update81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*7.4 update82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*7.4 update83VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*7.4 update84VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*7.4 update85VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*7.4 update86VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*7.4 update87VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*7.4 update88VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*7.4 update89VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*7.4 update90VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*7.4 update91VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*7.4 update92VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.4.3.75 to before 7.4.3.112VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:* Versions 7.4 update80 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* Versions 7.4 update81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* Versions 7.4 update82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* Versions 7.4 update83 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* Versions 7.4 update84 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* Versions 7.4 update85 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* Versions 7.4 update86 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:* Versions 7.4 update87 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:* Versions 7.4 update88 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:* Versions 7.4 update89 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:* Versions 7.4 update90 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:* Versions 7.4 update91 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:* Versions 7.4 update92 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.3.75 to before 7.4.3.112 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-6c4v-x9v2-rjm8 com.liferay.portal:release.portal.bom (Maven) Fixed in 7.4.3.112 Advisory →
  • Fix · GHSA-6c4v-x9v2-rjm8 com.liferay.portal:release.dxp.bom (Maven) Fixed in 2023.Q4.3 Advisory →
  • Fix · GHSA-6c4v-x9v2-rjm8 com.liferay.portal:release.dxp.bom (Maven) Fixed in 2023.Q3.6 Advisory →
  • Fix · GHSA-6c4v-x9v2-rjm8 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3u37 Advisory →
  • Fix · GHSA-6c4v-x9v2-rjm8 com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.4u93 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-26271
  2. 2026-10-03 Alias added: GHSA-6c4v-x9v2-rjm8

References

Advisory 2

Other 1

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences