PT-2008-1828 · Liferay · Liferay Portal

Tomasz Kuczynski · Published 2008-02-04 · Updated 2008-09-05 · CVE-2008-0182

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 4.4.0

Description A cross-site request forgery (CSRF) issue exists in the Admin portlet of Liferay Portal, allowing remote authenticated users to perform actions as other authenticated users via the Shutdown message.

Recommendations For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-0182

Affected Products

Liferay Portal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-0182 · Security Note
• http://secunia.com/advisories/28742 · Vendor Advisory
• http://kb.cert.org/vuls/id/767825 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0182 · Note
• http://support.liferay.com/browse/LEP-4739 · Note