GitHub Advisoryadvisory · Maven

GHSA-p2fc-xxr8-fw3p Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module

HIGH Published 2023-06-15 Modified 2025-08-08 Official page ↗
Aliases
CVE-2023-35030
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-08-08

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.70-ga70, < 7.4.3.77-ga77 → fixed in 7.4.3.77-ga77 • Maven com.liferay.portal:release.dxp.bom: >= 7.4.13.u70, <= 7.4.13.u76 (no fix yet)

Description

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Related

Alias · CVE (1)

  • CVE-2023-35030 Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References