GitHub Advisoryadvisory · Maven

GHSA-mh9r-9pcx-rx55 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page

HIGH Published 2024-02-21 Modified 2025-07-29 Official page ↗
Aliases
CVE-2021-29050
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.impl, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-07-29

Affected packages

• Maven com.liferay.portal:com.liferay.portal.impl: < 5.25.0 → fixed in 5.25.0 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp11 → fixed in 7.2.10.fp11

Description

Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in the implementation for the portal services package before 5.25.0 from Liferay Portal (before 7.3.6), and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.

Related

Alias · CVE (1)

  • CVE-2021-29050 Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References