CVE-2024-38002: Liferay Portal and Liferay DXP Workflow Component Lacks User Permission Checks
Summary
CVE-2024-38002: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions. Affects com.liferay.portal:release.portal.bom versions >= 7.3.2-ga3, < 7.4.3.112-ga112. Fixed in 7.4.3.112-ga112. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform designed for building web applications and managing digital experiences. It offers features such as content management, collaboration tools, and workflow management. The Liferay DXP (Digital Experience Platform) extends these capabilities for enterprise-level applications. However, certain versions of Liferay Portal and DXP have a critical vulnerability that compromises user permissions in the workflow component, allowing unauthorized modifications to workflow definitions.
Vulnerability Detail
The vulnerability arises from the workflow component in Liferay Portal versions 7.3.2 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. It fails to properly check user permissions before allowing updates to workflow definitions. This oversight enables remote authenticated users to modify workflow definitions and potentially execute arbitrary code through the headless API, leading to severe security risks.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.112-ga112
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the headless API for users who should not have permission to modify workflow definitions. This can be done by adjusting the user roles and permissions within the Liferay Portal settings.
Conclusion
CVE-2024-38002 presents a significant security risk for users of Liferay Portal and DXP due to inadequate permission checks in the workflow component. It is crucial for users to update to the latest patched versions to safeguard their applications against potential exploitation.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-38002 is a critical vulnerability in Liferay Portal and Liferay DXP that allows unauthorized users to modify workflow definitions due to insufficient permission checks.
The affected versions include Liferay Portal 7.3.2 to 7.4.3.111 and Liferay DXP 2023.Q4.0 to 2023.Q4.5, among others.
You can use Vulert, which monitors open-source vulnerabilities in real-time using just your pom.xml file. Visit Vulert Scanner to check your application without signing up.
The CVSS score for CVE-2024-38002 is 9.0, indicating a critical level of severity.
If immediate updates are not possible, implement access restrictions to the headless API to mitigate the risk of unauthorized modifications.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
