High severity8.8NVD Advisory· Published Oct 22, 2024· Updated Jun 17, 2026

CVE-2024-26273

Description

Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.liferay.portal:release.portal.bomMaven	>= 7.4.0, < 7.4.3.104	7.4.3.104
com.liferay.portal:release.dxp.bomMaven	>= 2023.Q4.0, < 2023.Q4.3	2023.Q4.3
com.liferay.portal:release.dxp.bomMaven	>= 2023.Q3.1, < 2023.Q3.6	2023.Q3.6
com.liferay.portal:release.dxp.bomMaven	>= 7.4.GA, < 7.4u93	7.4u93
com.liferay.portal:release.dxp.bomMaven	>= 7.3u29, < 7.3u36	7.3u36

Affected products

106

Liferay/Digital Experience Platform101 versions
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*+ 100 more
- cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*range: >=2023.q3.1,<2023.q3.6
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update1:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update2:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update3:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update4:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update5:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update6:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update7:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*
- cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*
Liferay/Portal2 versions
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*range: >=7.4.0,<7.4.3.104
- (no CPE)range: 7.4.0
ghsa-coords2 versions
pkg:maven/com.liferay.portal/release.dxp.bom pkg:maven/com.liferay.portal/release.portal.bom
>= 2023.Q4.0, < 2023.Q4.3+ 1 more
- (no CPE)range: >= 2023.Q4.0, < 2023.Q4.3
- (no CPE)range: >= 7.4.0, < 7.4.3.104
Liferay/DXPcpe-rescue
Range: 7.3.10-u29

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hmrx-6pr5-hpwjghsaADVISORY
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-26273ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000