SB2024102348 - Multiple vulnerabilities in Liferay Portal
Published: October 23, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Cross-site request forgery (CVE-ID: CVE-2024-26271)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the My Account widget. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website and change user passwords, shut down the server, execute arbitrary code in the scripting console, and perform other administrative actions via the _com_liferay_my_account_web_portlet_MyAccountPortlet_backURL parameter..
2) Missing Authorization (CVE-ID: CVE-2024-38002)
The vulnerability allows a remote user to execute arbitrary code on the system.
The vulnerability exists due to missing permissions check before updating a workflow definition. A remote user can modify workflow definitions and execute arbitrary code (RCE) via the headless API.
Remediation
Install update from vendor's website.