GitHub Advisoryadvisory · Maven

GHSA-3mfq-fp2f-vwqh Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

CRITICAL Published 2024-10-22 Modified 2025-08-08 Official page ↗
Aliases
CVE-2024-38002
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-862, CWE-863
Reviewed
2025-08-08

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.3.2-ga3, < 7.4.3.112-ga112 → fixed in 7.4.3.112-ga112 • Maven com.liferay.portal:release.dxp.bom: >= 2023.Q4.0, < 2023.Q4.6 → fixed in 2023.Q4.6 • Maven com.liferay.portal:release.dxp.bom: >= 2023.Q3.1, < 2023.Q3.9 → fixed in 2023.Q3.9 • Maven com.liferay.portal:release.dxp.bom: >= 7.3-ga, < 7.3.10.u36 → fixed in 7.3.10.u36 • Maven com.liferay.portal:release.dxp.bom: >= 7.4-ga, < 7.4.13.u92 → fixed in 7.4.13.u92

Description

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

Related

Alias · CVE (1)

  • CVE-2024-38002 The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8,… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References