CVE-2023-35030 — Liferay / Portal

Description (CNA)

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Affected (CNA)

Vendor / product	Versions
Liferay / Portal	affected 7.4.3.70 through 7.4.3.76
Liferay / DXP	affected 7.4.13.u70 through 7.4.13.u76

CWE

CWE-352

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030

ADP enrichment

CVE

No English description supplied.

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-35030

CISA-ADP

No English description supplied.

No references supplied.