2024-10-22 16:03:54 +00:00
{
"id" : "CVE-2024-26272" ,
"sourceIdentifier" : "security@liferay.com" ,
"published" : "2024-10-22T15:15:05.740" ,
2024-10-30 17:03:21 +00:00
"lastModified" : "2024-10-30T15:03:51.437" ,
"vulnStatus" : "Analyzed" ,
2024-10-22 16:03:54 +00:00
"cveTags" : [ ] ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter."
2024-10-23 16:03:56 +00:00
} ,
{
"lang" : "es" ,
"value" : " La vulnerabilidad de Cross-Site Request Forgery (CSRF) en el editor de p\u00e1ginas de contenido en Liferay Portal 7.3.2 a 7.4.3.107, y Liferay DXP 2023.Q4.0 a 2023.Q4.2, 2023.Q3.1 a 2023.Q3.5, 7.4 GA a la actualizaci\u00f3n 92 y 7.3 GA a la actualizaci\u00f3n 35 permite a atacantes remotos (1) cambiar las contrase\u00f1as de los usuarios, (2) apagar el servidor, (3) ejecutar c\u00f3digo arbitrario en la consola de scripts, (4) y realizar otras acciones administrativas a trav\u00e9s del par\u00e1metro p_l_back_url."
2024-10-22 16:03:54 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
2024-10-30 17:03:21 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "security@liferay.com" ,
"type" : "Secondary" ,
2024-10-30 17:03:21 +00:00
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 8.8 ,
"baseSeverity" : "HIGH" ,
2024-10-30 17:03:21 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2024-10-30 17:03:21 +00:00
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 5.9
} ,
2024-10-22 16:03:54 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2024-10-22 16:03:54 +00:00
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 8.8 ,
"baseSeverity" : "HIGH" ,
2024-10-22 16:03:54 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2024-10-22 16:03:54 +00:00
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 5.9
}
]
} ,
"weaknesses" : [
2024-10-30 17:03:21 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "security@liferay.com" ,
"type" : "Secondary" ,
2024-10-30 17:03:21 +00:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-352"
}
]
} ,
2024-10-22 16:03:54 +00:00
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2024-10-22 16:03:54 +00:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-352"
}
]
}
] ,
2024-10-30 17:03:21 +00:00
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "6F6A98ED-E694-4F39-95D0-C152BD1EC115"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*" ,
"matchCriteriaId" : "3E84D881-6D47-48FD-B743-9D531F5F7D5C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*" ,
"matchCriteriaId" : "660F37C6-61E6-4C34-8A7E-99C7DBEB8319"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*" ,
"matchCriteriaId" : "5AD8D0D3-31AC-41E5-A780-5D5B18BF6991"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*" ,
"matchCriteriaId" : "02D4C998-77F5-4428-A7B9-F7D909E23E92"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*" ,
"matchCriteriaId" : "C6984AC8-461D-488F-A911-7BF1D12B44A5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*" ,
"matchCriteriaId" : "BB5558B0-6714-4B3A-B287-1943517A975A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*" ,
"matchCriteriaId" : "294D8A56-A797-433C-A06E-106B2179151A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*" ,
"matchCriteriaId" : "824D88D9-4645-4CAD-8CAB-30F27DD388C4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*" ,
"matchCriteriaId" : "F6E8C952-B455-46E4-AC3D-D38CAF189F60"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*" ,
"matchCriteriaId" : "CD77C0EE-AC79-4443-A502-C1E02F806911"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*" ,
"matchCriteriaId" : "648EB53C-7A90-4DA6-BF1C-B5336CDE30C7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*" ,
"matchCriteriaId" : "39835EF7-8E93-4695-973D-6E9B76C67372"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*" ,
"matchCriteriaId" : "865ABA1F-CA99-4602-B325-F81C9778855C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:2023:q3.1:*:*:*:*:*:*" ,
"matchCriteriaId" : "1A13C2E9-9260-466E-9D98-0021CB2F41F8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:2023:q3.5:*:*:*:*:*:*" ,
"matchCriteriaId" : "08FB7951-AEED-4B44-8504-ACA10D5B99B1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:2023:q4.0:*:*:*:*:*:*" ,
"matchCriteriaId" : "B6C54C71-6885-475B-939B-CEC309579BBA"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:digital_experience_platform:2023:q4.2:*:*:*:*:*:*" ,
"matchCriteriaId" : "4E4B4759-C7D4-4A33-B1B8-29869F60FEE3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.3.2" ,
"versionEndIncluding" : "7.3.7" ,
"matchCriteriaId" : "4F2C2272-3E19-4836-BCA5-660208D5985D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.4.0" ,
"versionEndExcluding" : "7.4.3.108" ,
"matchCriteriaId" : "D23EB185-798C-4F89-8AAA-6D229BCD8BA4"
}
]
}
]
}
] ,
2024-10-22 16:03:54 +00:00
"references" : [
{
"url" : "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272" ,
2024-10-30 17:03:21 +00:00
"source" : "security@liferay.com" ,
"tags" : [
"Vendor Advisory"
]
2024-10-22 16:03:54 +00:00
}
]
}
