PT-2024-10916 · Liferay · Liferay Portal+1

Published 2024-02-20 · Updated 2024-08-01 · CVE-2021-29050

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.3.6 Liferay DXP 7.3 before service pack 1 Liferay DXP 7.2 before fix pack 11

Description A Cross-Site Request Forgery (CSRF) issue exists in the terms of use page, allowing remote attackers to accept the site's terms of use via social engineering by enticing the user to visit a malicious page.

Recommendations For Liferay Portal versions prior to 7.3.6, update to version 7.3.6 or later. For Liferay DXP 7.3 before service pack 1, apply service pack 1 or later. For Liferay DXP 7.2 before fix pack 11, apply fix pack 11 or later. As a temporary workaround, consider restricting access to the terms of use page until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-29050

GHSA-MH9R-9PCX-RX55

Affected Products

Liferay Dxp

Liferay Portal

References · 9

• https://osv.dev/vulnerability/GHSA-mh9r-9pcx-rx55 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29050 · Security Note
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/1295dcd8173ac820e501d0e9b3bf1da97ea8b7d4 · Note
• https://github.com/liferay/liferay-portal/commit/f2723cb2e8dacfbd140ff5f255bb7d21a11c476d · Note
• https://t.me/cvenotify/72051 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17207 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-29050 · Note
• https://twitter.com/CVEnew/status/1760071864981049741 · Twitter Post