CVE-2024-26271

Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q3.1:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q3.5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q4.0:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q4.2:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

History

30 Oct 2024, 15:04

Type Values Removed Values Added
References () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26271 - () https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26271 - Vendor Advisory
CPE cpe:2.3:a:liferay:digital_experience_platform:2023:q4.0:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q4.2:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q3.5:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
cpe:2.3:a:liferay:digital_experience_platform:2023:q3.1:*:*:*:*:*:*
First Time Liferay
Liferay liferay Portal
Liferay digital Experience Platform

23 Oct 2024, 15:12

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de Cross-Site Request Forgery (CSRF) en el widget Mi cuenta en Liferay Portal 7.4.3.75 a 7.4.3.111, y Liferay DXP 2023.Q4.0 a 2023.Q4.2, 2023.Q3.1 a 2023.Q3.5, 7.4 actualización 75 a 92 y 7.3 actualización 32 a 36 permite a atacantes remotos (1) cambiar las contraseñas de los usuarios, (2) apagar el servidor, (3) ejecutar código arbitrario en la consola de scripts, (4) y realizar otras acciones administrativas a través del parámetro _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL.

22 Oct 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-22 15:15

Updated : 2024-10-30 15:04


NVD link : CVE-2024-26271

Mitre link : CVE-2024-26271

CVE.ORG link : CVE-2024-26271


JSON object : View

Products Affected

liferay

  • liferay_portal
  • digital_experience_platform
CWE
CWE-352

Cross-Site Request Forgery (CSRF)