Description

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Remediation

References

CVE-2023-35030

Related Vulnerabilities

WordPress 3.5 Multiple Vulnerabilities (1.5 - 3.5)

Apache HTTP Server Other Vulnerability (CVE-2002-0840)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-1864)

WordPress Plugin User Verification Security Bypass (1.0.93)

WordPress Plugin BackWPup Cross-Site Scripting (3.0.12)

Severity

High

Classification

CVE-2023-35030 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities