CVE-2023-35030

HighCVSS 8.8

Published: 15/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76 and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Risk Assessment

This vulnerability could lead to unauthorized access and execution of malicious code, posing a serious threat to the security of the system and user data.

Recommendation

It is recommended to update Liferay Portal and Liferay DXP to the latest version to eliminate this vulnerability. Additionally, implementing CSRF protection mechanisms is advisable.

Other vulnerabilities in Liferay Portal 7.4.3.70 do 7.4.3.76, Liferay DXP 7.4 aktualizacja 70 do 76

CVE-2023-35029Medium
An open redirect vulnerability exists in the SEO configuration of the Layout module in Liferay Portal versions 7.4.3.70 through 7.4.3.76 and Liferay DXP update 70 through 76. Attackers can exploit the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter to redirect users to arbitrary external URLs.

Original NVD description (English source)

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS