NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2024-8980: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

criticalCVSS 3.1 9.6GHSA-chj2-4vg7-hhg3

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy…

Published Oct 22, 2024 · Updated Jul 29, 2025

Affected packages

com.liferay.portal:release.portal.bom

Ecosystem
Maven
Affected
>= 7.0.0-a1, < 7.4.3.102-GA102
Fixed in
7.4.3.102-GA102
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.portal.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 2023.Q3.1, < 2023.Q3.5
Fixed in
2023.Q3.5
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 7.0.0-GA, <= 7.0.10.fp102
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 7.1.0-GA, <= 7.1.10.fp28
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 7.2.0.GA, <= 7.2.10.fp20
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 7.3.0-GA, < 7.3.10.u36
Fixed in
7.3.10.u36
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

com.liferay.portal:release.dxp.bom

Ecosystem
Maven
Affected
>= 7.4.0-GA, <= 7.4.13.u92
Fixed in
No patched version yet
Check
mvn dependency:tree -Dincludes=com.liferay.portal:release.dxp.bom

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries