Paper/Archive/CVE-2024-38002

CVE-2024-38002

Liferay Portal — The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.…

EPSS 0.6%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 51.1.511 × 2010.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

Affected

ProductAffectedFixed inSource

Portal7.3.2 – 7.3.7–CNA

Portal7.4.0 – 7.4.3.111–CNA

DXP7.3.10 – 7.3.10-u36–CNA

DXP7.4.13 – 7.4.13-u92–CNA

DXP2023.Q3.1 – 2023.Q3.8–CNA

DXP2023.Q4.0 – 2023.Q4.5–CNA

portal7.4.0 – 7.4.3.111–CISA-ADP

portal7.3.2 – 7.3.7–CISA-ADP

dxp2023.q4.0 – 2023.q4.5–CISA-ADP

dxp2023.q3.1 – 2023.q3.8–CISA-ADP

dxp7.4–CISA-ADP

dxp7.3–CISA-ADP

Scores by source

Liferay (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refliferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002