CVE-2024-26272
Published: 22 October 2024
Summary
CVE-2024-26272 is a high-severity CSRF (CWE-352) vulnerability in Liferay Digital Experience Platform. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 12.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-26272 is a cross-site request forgery vulnerability (CWE-352) affecting the content page editor component in Liferay Portal versions 7.3.2 through 7.4.3.107 and Liferay DXP releases including 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and 7.3 GA through update 35. The flaw is reachable through the p_l_back_url parameter and carries a CVSS 3.1 base score of 8.8.
Remote attackers can exploit the issue by tricking an authenticated administrative user into performing an action that submits a forged request, enabling password changes, server shutdown, arbitrary code execution in the scripting console, and other administrative operations without requiring direct authentication from the attacker.
The sole reference points to Liferay's security advisory page for this CVE, which is the authoritative source for any available patches or configuration guidance. The EPSS score rose from a low baseline to a peak of 0.0613 on 2026-03-13 before receding to the current value of 0.0326, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23544
Vulnerability details
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to…
more
(1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.