{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8980", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "state": "PUBLISHED", "assignerShortName": "Liferay", "dateReserved": "2024-09-18T18:04:13.531Z", "datePublished": "2024-10-22T14:43:04.606Z", "dateUpdated": "2024-10-22T15:08:48.472Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Portal", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "7.4.3.101", "status": "affected", "version": "7.0.0", "versionType": "maven"}]}, {"defaultStatus": "unaffected", "product": "DXP", "vendor": "Liferay", "versions": [{"lessThanOrEqual": "portal-173", "status": "affected", "version": "6.2.0", "versionType": "maven"}, {"lessThanOrEqual": "de-102", "status": "affected", "version": "7.0.10", "versionType": "maven"}, {"lessThanOrEqual": "dxp-28", "status": "affected", "version": "7.1.10", "versionType": "maven"}, {"lessThanOrEqual": "dxp-20", "status": "affected", "version": "7.2.10", "versionType": "maven"}, {"lessThanOrEqual": "7.3.10-u35", "status": "affected", "version": "7.3.10", "versionType": "maven"}, {"lessThanOrEqual": "7.4.13-u92", "status": "affected", "version": "7.4.13", "versionType": "maven"}, {"lessThanOrEqual": "2023.Q3.4", "status": "affected", "version": "2023.Q3.1", "versionType": "maven"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173<br> does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability."}], "value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\n does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-10-22T14:43:04.606Z"}, "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "liferay", "product": "portal", "cpes": ["cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7.4.0", "status": "affected", "lessThanOrEqual": "7.4.3.101", "versionType": "maven"}, {"version": "7.3.0", "status": "affected", "lessThanOrEqual": "7.3.7", "versionType": "maven"}, {"version": "7.2.0", "status": "affected", "lessThanOrEqual": "7.2.1", "versionType": "maven"}, {"version": "7.1.0", "status": "affected", "lessThanOrEqual": "7.1.3", "versionType": "maven"}, {"version": "7.0.0", "status": "affected", "lessThanOrEqual": "2023.q3.4", "versionType": "maven"}]}, {"vendor": "liferay", "product": "dxp", "cpes": ["cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2023.q3.1", "status": "affected", "lessThanOrEqual": "2023.q3.4", "versionType": "maven"}, {"version": "7.4", "status": "affected"}, {"version": "7.3ga", "status": "affected", "lessThanOrEqual": "update35", "versionType": "maven"}, {"version": "7.2", "status": "affected"}, {"version": "7.1", "status": "affected"}, {"version": "7.0", "status": "affected"}, {"version": "6.2", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T15:02:17.489238Z", "id": "CVE-2024-8980", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T15:08:48.472Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-22T15:02:17.489238Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:liferay:portal:*:*:*:*:*:*:*:*"], "vendor": "liferay", "product": "portal", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.101"}, {"status": "affected", "version": "7.3.0", "versionType": "maven", "lessThanOrEqual": "7.3.7"}, {"status": "affected", "version": "7.2.0", "versionType": "maven", "lessThanOrEqual": "7.2.1"}, {"status": "affected", "version": "7.1.0", "versionType": "maven", "lessThanOrEqual": "7.1.3"}, {"status": "affected", "version": "7.0.0", "versionType": "maven", "lessThanOrEqual": "2023.q3.4"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:liferay:dxp:*:*:*:*:*:*:*:*"], "vendor": "liferay", "product": "dxp", "versions": [{"status": "affected", "version": "2023.q3.1", "versionType": "maven", "lessThanOrEqual": "2023.q3.4"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3ga", "versionType": "maven", "lessThanOrEqual": "update35"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "6.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T15:08:23.556Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Liferay", "product": "Portal", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "maven", "lessThanOrEqual": "7.4.3.101"}], "defaultStatus": "unaffected"}, {"vendor": "Liferay", "product": "DXP", "versions": [{"status": "affected", "version": "6.2.0", "versionType": "maven", "lessThanOrEqual": "portal-173"}, {"status": "affected", "version": "7.0.10", "versionType": "maven", "lessThanOrEqual": "de-102"}, {"status": "affected", "version": "7.1.10", "versionType": "maven", "lessThanOrEqual": "dxp-28"}, {"status": "affected", "version": "7.2.10", "versionType": "maven", "lessThanOrEqual": "dxp-20"}, {"status": "affected", "version": "7.3.10", "versionType": "maven", "lessThanOrEqual": "7.3.10-u35"}, {"status": "affected", "version": "7.4.13", "versionType": "maven", "lessThanOrEqual": "7.4.13-u92"}, {"status": "affected", "version": "2023.Q3.1", "versionType": "maven", "lessThanOrEqual": "2023.Q3.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\n does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.", "supportingMedia": [{"type": "text/html", "value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173<br> does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "shortName": "Liferay", "dateUpdated": "2024-10-22T14:43:04.606Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8980", "state": "PUBLISHED", "dateUpdated": "2024-10-22T15:08:48.472Z", "dateReserved": "2024-09-18T18:04:13.531Z", "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3", "datePublished": "2024-10-22T14:43:04.606Z", "assignerShortName": "Liferay"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:liferay:digital_experience_platform:6.2:-:*:*:*:*:*:*", "matchCriteriaId": "6BFA6FB8-865E-4C8B-B0CF-CB3C47C18DD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.0:-:*:*:*:*:*:*", "matchCriteriaId": "4614C87F-F39C-4ADD-A7A2-4A498612AD38", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.1:-:*:*:*:*:*:*", "matchCriteriaId": "27DF695E-B890-42C2-8941-5BB53154755F", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.2:-:*:*:*:*:*:*", "matchCriteriaId": "0DCF7F39-A198-4F7E-84B7-90C88C1BAA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:*", "matchCriteriaId": "6F6A98ED-E694-4F39-95D0-C152BD1EC115", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:*", "matchCriteriaId": "3E84D881-6D47-48FD-B743-9D531F5F7D5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:*", "matchCriteriaId": "C6984AC8-461D-488F-A911-7BF1D12B44A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*", "matchCriteriaId": "96E84DBC-C740-4E23-8D1D-83C8AE49813E", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023:q3.1:*:*:*:*:*:*", "matchCriteriaId": "1A13C2E9-9260-466E-9D98-0021CB2F41F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:digital_experience_platform:2023:q3.4:*:*:*:*:*:*", "matchCriteriaId": "951E7698-7E66-4671-84E9-7A7B0FB15B23", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "7471D27F-6FDF-4214-9DAF-CC68CE6DB80D", "versionEndExcluding": "7.0.6", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "74992E49-BDF7-4AE0-A1F1-A2DD59ED6F2D", "versionEndExcluding": "7.1.3", "versionStartIncluding": "7.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7CAF8FC-6334-48FD-A3E0-83EE307A5210", "versionEndIncluding": "7.2.1", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "13F59EAA-9EC8-44CC-8F56-BC26981F584F", "versionEndIncluding": "7.3.7", "versionStartIncluding": "7.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", "matchCriteriaId": "79CB407F-11CB-45E9-AE4D-5926AE59EA0F", "versionEndExcluding": "7.4.3.102", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173\n does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability."}, {"lang": "es", "value": "La consola de scripts en Liferay Portal 7.0.0 a 7.4.3.101, y Liferay DXP 2023.Q3.1 a 2023.Q3.4, 7.4 GA a la actualizaci\u00f3n 92, 7.3 GA a la actualizaci\u00f3n 35, 7.2 GA a trav\u00e9s del fixpack 20, 7.1 GA a trav\u00e9s del fixpack 28, 7.0 GA a trav\u00e9s del fixpack 102 y 6.2 GA a trav\u00e9s del fixpack 173 no protege lo suficiente contra ataques de Cross-Site Request Forgery (CSRF), que permiten a atacantes remotos ejecutar scripts de Groovy arbitrarios a trav\u00e9s de una URL manipulada o una vulnerabilidad XSS."}], "id": "CVE-2024-8980", "lastModified": "2024-10-30T14:46:14.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security@liferay.com", "type": "Secondary"}]}, "published": "2024-10-22T15:15:07.337", "references": [{"source": "security@liferay.com", "tags": ["Vendor Advisory"], "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980"}], "sourceIdentifier": "security@liferay.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@liferay.com", "type": "Secondary"}]}

{}