Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Digital_experience_platform | Liferay | 2023.q3.1 (including) | 2023.q3.6 (excluding) |
| Digital_experience_platform | Liferay | 2023.q4.0 (including) | 2023.q4.3 (excluding) |
| Digital_experience_platform | Liferay | 7.3-update29 (including) | 7.3-update29 (including) |
| Digital_experience_platform | Liferay | 7.3-update30 (including) | 7.3-update30 (including) |
| Digital_experience_platform | Liferay | 7.3-update31 (including) | 7.3-update31 (including) |
| Digital_experience_platform | Liferay | 7.3-update32 (including) | 7.3-update32 (including) |
| Digital_experience_platform | Liferay | 7.3-update33 (including) | 7.3-update33 (including) |
| Digital_experience_platform | Liferay | 7.3-update34 (including) | 7.3-update34 (including) |
| Digital_experience_platform | Liferay | 7.3-update35 (including) | 7.3-update35 (including) |
| Digital_experience_platform | Liferay | 7.4 (including) | 7.4 (including) |
| Digital_experience_platform | Liferay | 7.4-update1 (including) | 7.4-update1 (including) |
| Digital_experience_platform | Liferay | 7.4-update10 (including) | 7.4-update10 (including) |
| Digital_experience_platform | Liferay | 7.4-update11 (including) | 7.4-update11 (including) |
| Digital_experience_platform | Liferay | 7.4-update12 (including) | 7.4-update12 (including) |
| Digital_experience_platform | Liferay | 7.4-update13 (including) | 7.4-update13 (including) |
| Digital_experience_platform | Liferay | 7.4-update14 (including) | 7.4-update14 (including) |
| Digital_experience_platform | Liferay | 7.4-update15 (including) | 7.4-update15 (including) |
| Digital_experience_platform | Liferay | 7.4-update16 (including) | 7.4-update16 (including) |
| Digital_experience_platform | Liferay | 7.4-update17 (including) | 7.4-update17 (including) |
| Digital_experience_platform | Liferay | 7.4-update18 (including) | 7.4-update18 (including) |
| Digital_experience_platform | Liferay | 7.4-update19 (including) | 7.4-update19 (including) |
| Digital_experience_platform | Liferay | 7.4-update2 (including) | 7.4-update2 (including) |
| Digital_experience_platform | Liferay | 7.4-update20 (including) | 7.4-update20 (including) |
| Digital_experience_platform | Liferay | 7.4-update21 (including) | 7.4-update21 (including) |
| Digital_experience_platform | Liferay | 7.4-update22 (including) | 7.4-update22 (including) |
| Digital_experience_platform | Liferay | 7.4-update23 (including) | 7.4-update23 (including) |
| Digital_experience_platform | Liferay | 7.4-update24 (including) | 7.4-update24 (including) |
| Digital_experience_platform | Liferay | 7.4-update25 (including) | 7.4-update25 (including) |
| Digital_experience_platform | Liferay | 7.4-update26 (including) | 7.4-update26 (including) |
| Digital_experience_platform | Liferay | 7.4-update27 (including) | 7.4-update27 (including) |
| Digital_experience_platform | Liferay | 7.4-update28 (including) | 7.4-update28 (including) |
| Digital_experience_platform | Liferay | 7.4-update29 (including) | 7.4-update29 (including) |
| Digital_experience_platform | Liferay | 7.4-update3 (including) | 7.4-update3 (including) |
| Digital_experience_platform | Liferay | 7.4-update30 (including) | 7.4-update30 (including) |
| Digital_experience_platform | Liferay | 7.4-update31 (including) | 7.4-update31 (including) |
| Digital_experience_platform | Liferay | 7.4-update32 (including) | 7.4-update32 (including) |
| Digital_experience_platform | Liferay | 7.4-update33 (including) | 7.4-update33 (including) |
| Digital_experience_platform | Liferay | 7.4-update34 (including) | 7.4-update34 (including) |
| Digital_experience_platform | Liferay | 7.4-update35 (including) | 7.4-update35 (including) |
| Digital_experience_platform | Liferay | 7.4-update36 (including) | 7.4-update36 (including) |
| Digital_experience_platform | Liferay | 7.4-update37 (including) | 7.4-update37 (including) |
| Digital_experience_platform | Liferay | 7.4-update38 (including) | 7.4-update38 (including) |
| Digital_experience_platform | Liferay | 7.4-update39 (including) | 7.4-update39 (including) |
| Digital_experience_platform | Liferay | 7.4-update4 (including) | 7.4-update4 (including) |
| Digital_experience_platform | Liferay | 7.4-update40 (including) | 7.4-update40 (including) |
| Digital_experience_platform | Liferay | 7.4-update41 (including) | 7.4-update41 (including) |
| Digital_experience_platform | Liferay | 7.4-update42 (including) | 7.4-update42 (including) |
| Digital_experience_platform | Liferay | 7.4-update43 (including) | 7.4-update43 (including) |
| Digital_experience_platform | Liferay | 7.4-update44 (including) | 7.4-update44 (including) |
| Digital_experience_platform | Liferay | 7.4-update45 (including) | 7.4-update45 (including) |
| Digital_experience_platform | Liferay | 7.4-update46 (including) | 7.4-update46 (including) |
| Digital_experience_platform | Liferay | 7.4-update47 (including) | 7.4-update47 (including) |
| Digital_experience_platform | Liferay | 7.4-update48 (including) | 7.4-update48 (including) |
| Digital_experience_platform | Liferay | 7.4-update49 (including) | 7.4-update49 (including) |
| Digital_experience_platform | Liferay | 7.4-update5 (including) | 7.4-update5 (including) |
| Digital_experience_platform | Liferay | 7.4-update50 (including) | 7.4-update50 (including) |
| Digital_experience_platform | Liferay | 7.4-update51 (including) | 7.4-update51 (including) |
| Digital_experience_platform | Liferay | 7.4-update52 (including) | 7.4-update52 (including) |
| Digital_experience_platform | Liferay | 7.4-update53 (including) | 7.4-update53 (including) |
| Digital_experience_platform | Liferay | 7.4-update54 (including) | 7.4-update54 (including) |
| Digital_experience_platform | Liferay | 7.4-update55 (including) | 7.4-update55 (including) |
| Digital_experience_platform | Liferay | 7.4-update56 (including) | 7.4-update56 (including) |
| Digital_experience_platform | Liferay | 7.4-update57 (including) | 7.4-update57 (including) |
| Digital_experience_platform | Liferay | 7.4-update58 (including) | 7.4-update58 (including) |
| Digital_experience_platform | Liferay | 7.4-update59 (including) | 7.4-update59 (including) |
| Digital_experience_platform | Liferay | 7.4-update6 (including) | 7.4-update6 (including) |
| Digital_experience_platform | Liferay | 7.4-update60 (including) | 7.4-update60 (including) |
| Digital_experience_platform | Liferay | 7.4-update61 (including) | 7.4-update61 (including) |
| Digital_experience_platform | Liferay | 7.4-update62 (including) | 7.4-update62 (including) |
| Digital_experience_platform | Liferay | 7.4-update63 (including) | 7.4-update63 (including) |
| Digital_experience_platform | Liferay | 7.4-update64 (including) | 7.4-update64 (including) |
| Digital_experience_platform | Liferay | 7.4-update65 (including) | 7.4-update65 (including) |
| Digital_experience_platform | Liferay | 7.4-update66 (including) | 7.4-update66 (including) |
| Digital_experience_platform | Liferay | 7.4-update67 (including) | 7.4-update67 (including) |
| Digital_experience_platform | Liferay | 7.4-update68 (including) | 7.4-update68 (including) |
| Digital_experience_platform | Liferay | 7.4-update69 (including) | 7.4-update69 (including) |
| Digital_experience_platform | Liferay | 7.4-update7 (including) | 7.4-update7 (including) |
| Digital_experience_platform | Liferay | 7.4-update70 (including) | 7.4-update70 (including) |
| Digital_experience_platform | Liferay | 7.4-update71 (including) | 7.4-update71 (including) |
| Digital_experience_platform | Liferay | 7.4-update72 (including) | 7.4-update72 (including) |
| Digital_experience_platform | Liferay | 7.4-update73 (including) | 7.4-update73 (including) |
| Digital_experience_platform | Liferay | 7.4-update74 (including) | 7.4-update74 (including) |
| Digital_experience_platform | Liferay | 7.4-update75 (including) | 7.4-update75 (including) |
| Digital_experience_platform | Liferay | 7.4-update76 (including) | 7.4-update76 (including) |
| Digital_experience_platform | Liferay | 7.4-update77 (including) | 7.4-update77 (including) |
| Digital_experience_platform | Liferay | 7.4-update78 (including) | 7.4-update78 (including) |
| Digital_experience_platform | Liferay | 7.4-update79 (including) | 7.4-update79 (including) |
| Digital_experience_platform | Liferay | 7.4-update8 (including) | 7.4-update8 (including) |
| Digital_experience_platform | Liferay | 7.4-update80 (including) | 7.4-update80 (including) |
| Digital_experience_platform | Liferay | 7.4-update81 (including) | 7.4-update81 (including) |
| Digital_experience_platform | Liferay | 7.4-update82 (including) | 7.4-update82 (including) |
| Digital_experience_platform | Liferay | 7.4-update83 (including) | 7.4-update83 (including) |
| Digital_experience_platform | Liferay | 7.4-update84 (including) | 7.4-update84 (including) |
| Digital_experience_platform | Liferay | 7.4-update85 (including) | 7.4-update85 (including) |
| Digital_experience_platform | Liferay | 7.4-update86 (including) | 7.4-update86 (including) |
| Digital_experience_platform | Liferay | 7.4-update87 (including) | 7.4-update87 (including) |
| Digital_experience_platform | Liferay | 7.4-update88 (including) | 7.4-update88 (including) |
| Digital_experience_platform | Liferay | 7.4-update89 (including) | 7.4-update89 (including) |
| Digital_experience_platform | Liferay | 7.4-update9 (including) | 7.4-update9 (including) |
| Digital_experience_platform | Liferay | 7.4-update90 (including) | 7.4-update90 (including) |
| Digital_experience_platform | Liferay | 7.4-update91 (including) | 7.4-update91 (including) |
| Digital_experience_platform | Liferay | 7.4-update92 (including) | 7.4-update92 (including) |
| Liferay_portal | Liferay | 7.4.0 (including) | 7.4.3.104 (excluding) |