VIR Vulnerability Intelligence Relay

CVE-2024-8980

unknown
Published 2024-10-22 · Modified 2025-07-29
CVSS v3
—
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v2
—
VIR risk
—

Description

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Package impact
EcosystemPackageVulnerableFixed
java Mavencom.liferay.portal:release.portal.bom>=7.0.0-a1,<7.4.3.102-GA1027.4.3.102-GA102
java Mavencom.liferay.portal:release.dxp.bom>=2023.Q3.1,<2023.Q3.52023.Q3.5
java Mavencom.liferay.portal:release.dxp.bom>=7.0.0-GA,<=7.0.10.fp102
java Mavencom.liferay.portal:release.dxp.bom>=7.1.0-GA,<=7.1.10.fp28
java Mavencom.liferay.portal:release.dxp.bom>=7.2.0.GA,<=7.2.10.fp20
java Mavencom.liferay.portal:release.dxp.bom>=7.3.0-GA,<7.3.10.u367.3.10.u36
java Mavencom.liferay.portal:release.dxp.bom>=7.4.0-GA,<=7.4.13.u92

References

Verify integrity in audit chain (admin only). AS-IS.