CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-26271

Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 22.0%

CVSS Severity

CVSS v3 Score 8.8

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26271

Products affected by CVE-2024-26271

Liferay » Digital Experience Platform » Version: 2023.q3.1

cpe:2.3:a:liferay:digital_experience_platform:2023.q3.1
Liferay » Digital Experience Platform » Version: 2023.q3.2

cpe:2.3:a:liferay:digital_experience_platform:2023.q3.2
Liferay » Digital Experience Platform » Version: 2023.q3.3

cpe:2.3:a:liferay:digital_experience_platform:2023.q3.3
Liferay » Digital Experience Platform » Version: 2023.q3.4

cpe:2.3:a:liferay:digital_experience_platform:2023.q3.4
Liferay » Digital Experience Platform » Version: 2023.q3.5

cpe:2.3:a:liferay:digital_experience_platform:2023.q3.5
Liferay » Digital Experience Platform » Version: 2023.q4.0

cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0
Liferay » Digital Experience Platform » Version: 2023.q4.1

cpe:2.3:a:liferay:digital_experience_platform:2023.q4.1
Liferay » Digital Experience Platform » Version: 2023.q4.2

cpe:2.3:a:liferay:digital_experience_platform:2023.q4.2
Liferay » Digital Experience Platform » Version: 7.3

cpe:2.3:a:liferay:digital_experience_platform:7.3
Liferay » Digital Experience Platform » Version: 7.4

cpe:2.3:a:liferay:digital_experience_platform:7.4
Liferay » Liferay Portal » Version: 7.4.3.100

cpe:2.3:a:liferay:liferay_portal:7.4.3.100
Liferay » Liferay Portal » Version: 7.4.3.101

cpe:2.3:a:liferay:liferay_portal:7.4.3.101
Liferay » Liferay Portal » Version: 7.4.3.102

cpe:2.3:a:liferay:liferay_portal:7.4.3.102
Liferay » Liferay Portal » Version: 7.4.3.103

cpe:2.3:a:liferay:liferay_portal:7.4.3.103
Liferay » Liferay Portal » Version: 7.4.3.104

cpe:2.3:a:liferay:liferay_portal:7.4.3.104
Liferay » Liferay Portal » Version: 7.4.3.105

cpe:2.3:a:liferay:liferay_portal:7.4.3.105
Liferay » Liferay Portal » Version: 7.4.3.106

cpe:2.3:a:liferay:liferay_portal:7.4.3.106
Liferay » Liferay Portal » Version: 7.4.3.107

cpe:2.3:a:liferay:liferay_portal:7.4.3.107
Liferay » Liferay Portal » Version: 7.4.3.108

cpe:2.3:a:liferay:liferay_portal:7.4.3.108
Liferay » Liferay Portal » Version: 7.4.3.109

cpe:2.3:a:liferay:liferay_portal:7.4.3.109
Liferay » Liferay Portal » Version: 7.4.3.110

cpe:2.3:a:liferay:liferay_portal:7.4.3.110
Liferay » Liferay Portal » Version: 7.4.3.111

cpe:2.3:a:liferay:liferay_portal:7.4.3.111
Liferay » Liferay Portal » Version: 7.4.3.75

cpe:2.3:a:liferay:liferay_portal:7.4.3.75
Liferay » Liferay Portal » Version: 7.4.3.76

cpe:2.3:a:liferay:liferay_portal:7.4.3.76
Liferay » Liferay Portal » Version: 7.4.3.77

cpe:2.3:a:liferay:liferay_portal:7.4.3.77
Liferay » Liferay Portal » Version: 7.4.3.78

cpe:2.3:a:liferay:liferay_portal:7.4.3.78
Liferay » Liferay Portal » Version: 7.4.3.79

cpe:2.3:a:liferay:liferay_portal:7.4.3.79
Liferay » Liferay Portal » Version: 7.4.3.80

cpe:2.3:a:liferay:liferay_portal:7.4.3.80
Liferay » Liferay Portal » Version: 7.4.3.81

cpe:2.3:a:liferay:liferay_portal:7.4.3.81
Liferay » Liferay Portal » Version: 7.4.3.82

cpe:2.3:a:liferay:liferay_portal:7.4.3.82
Liferay » Liferay Portal » Version: 7.4.3.83

cpe:2.3:a:liferay:liferay_portal:7.4.3.83
Liferay » Liferay Portal » Version: 7.4.3.84

cpe:2.3:a:liferay:liferay_portal:7.4.3.84
Liferay » Liferay Portal » Version: 7.4.3.85

cpe:2.3:a:liferay:liferay_portal:7.4.3.85
Liferay » Liferay Portal » Version: 7.4.3.86

cpe:2.3:a:liferay:liferay_portal:7.4.3.86
Liferay » Liferay Portal » Version: 7.4.3.87

cpe:2.3:a:liferay:liferay_portal:7.4.3.87
Liferay » Liferay Portal » Version: 7.4.3.88

cpe:2.3:a:liferay:liferay_portal:7.4.3.88
Liferay » Liferay Portal » Version: 7.4.3.89

cpe:2.3:a:liferay:liferay_portal:7.4.3.89
Liferay » Liferay Portal » Version: 7.4.3.90

cpe:2.3:a:liferay:liferay_portal:7.4.3.90
Liferay » Liferay Portal » Version: 7.4.3.91

cpe:2.3:a:liferay:liferay_portal:7.4.3.91
Liferay » Liferay Portal » Version: 7.4.3.92

cpe:2.3:a:liferay:liferay_portal:7.4.3.92
Liferay » Liferay Portal » Version: 7.4.3.94

cpe:2.3:a:liferay:liferay_portal:7.4.3.94
Liferay » Liferay Portal » Version: 7.4.3.95

cpe:2.3:a:liferay:liferay_portal:7.4.3.95
Liferay » Liferay Portal » Version: 7.4.3.96

cpe:2.3:a:liferay:liferay_portal:7.4.3.96
Liferay » Liferay Portal » Version: 7.4.3.97

cpe:2.3:a:liferay:liferay_portal:7.4.3.97
Liferay » Liferay Portal » Version: 7.4.3.98

cpe:2.3:a:liferay:liferay_portal:7.4.3.98
Liferay » Liferay Portal » Version: 7.4.3.99

cpe:2.3:a:liferay:liferay_portal:7.4.3.99

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-26271

Products

Pricing

Contact Us