PT-2024-27845 · Liferay · Liferay Portal+1

Dave Jong · Published 2024-07-12 · Updated 2024-12-30 · CVE-2024-37940

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator (Full, premium) versions n/a through 2.21.13 Liferay Portal and DXP versions 7.0.0 through 7.4.3.87

Description A Cross-Site Request Forgery (CSRF) vulnerability and a medium severity XSS vulnerability have been identified. The XSS vulnerability allows attackers to inject scripts into the Service Class field, posing a security risk.

Recommendations For Seraphinite Accelerator (Full, premium) versions n/a through 2.21.13, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Liferay Portal and DXP versions 7.0.0 through 7.4.3.87, upgrade to the latest version to stay secure.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-37940

Affected Products

Liferay Dxp

Liferay Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-37940 · Security Note
• https://twitter.com/Hossted_OSS/status/1873641920754561507 · Twitter Post
• https://t.me/cvedetector/748 · Telegram Post
• https://patchstack.com/database/vulnerability/seraphinite-accelerator-ext/wordpress-seraphinite-accelerator-full-premium-plugin-2-21-13-csrf-leading-to-arbitrary-file-deletion-vulnerability?_s_id=cve · Note