Open-source package vulnerability · Maven

CVE-2024-38002: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

criticalCVSS 3.1 9.0GHSA-3mfq-fp2f-vwqh

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

Published Oct 22, 2024 · Updated Sep 10, 2025

Affected packages

com.liferay.portal:release.portal.bom

Ecosystem: Maven
Affected: >= 7.3.2-ga3, < 7.4.3.112-ga112
Fixed in: 7.4.3.112-ga112
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.portal.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 2023.Q4.0, < 2023.Q4.6
Fixed in: 2023.Q4.6
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 2023.Q3.1, < 2023.Q3.9
Fixed in: 2023.Q3.9
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 7.3-ga, < 7.3.10.u36
Fixed in: 7.3.10.u36
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem: Maven
Affected: >= 7.4-ga, < 7.4.13.u92
Fixed in: 7.4.13.u92
Check: mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries