CVE-2023-35030: CSRF Vulnerability in Liferay Portal and Liferay DXP Layout Module
Summary
CVE-2023-35030: Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module. Affects com.liferay.portal:release.portal.bom versions >= 7.4.3.70-ga70, < 7.4.3.77-ga77. Fixed in 7.4.3.77-ga77. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a powerful platform for building web applications and managing content. It provides a robust framework for developers to create customizable solutions for businesses. The Layout module within Liferay is responsible for managing the layout and SEO configurations of web pages. However, a critical vulnerability has been identified in this module, affecting versions 7.4.3.70 through 7.4.3.76 of Liferay Portal and 7.4 update 70 through 76 of Liferay DXP.
Vulnerability Detail
The vulnerability is a Cross-Site Request Forgery (CSRF) issue that allows remote attackers to execute arbitrary code in the scripting console by exploiting the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL parameter. This can lead to unauthorized actions being performed on behalf of authenticated users, potentially compromising the integrity and security of the application.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.77-ga77
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing CSRF tokens in your forms to mitigate the risk of CSRF attacks. Ensure that all state-changing requests are protected by validating a CSRF token on the server side.
Conclusion
The CSRF vulnerability identified as CVE-2023-35030 poses a significant risk to users of Liferay Portal and Liferay DXP. It is crucial to update to the latest patched versions to safeguard against potential exploitation. Additionally, implementing CSRF tokens can provide an extra layer of security until the update is applied.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2023-35030 is a vulnerability in the Layout module of Liferay Portal and Liferay DXP that allows CSRF attacks, enabling remote code execution.
The vulnerability affects Liferay Portal versions 7.4.3.70 to 7.4.3.76 and Liferay DXP versions 7.4 update 70 to 76.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Implement CSRF tokens in your forms as a temporary workaround to protect against CSRF attacks until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
