CVE-2024-8980: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console
Summary
CVE-2024-8980: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console. Affects com.liferay.portal:release.portal.bom versions >= 7.0.0-a1, < 7.4.3.102-GA102. Fixed in 7.4.3.102-GA102. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal and Liferay DXP are widely used platforms for building enterprise web applications. They provide a robust set of features for content management, collaboration, and workflow automation. The Script Console is a powerful tool within these platforms that allows administrators to execute Groovy scripts for various administrative tasks. However, a critical vulnerability has been identified that compromises the security of this tool, exposing it to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability arises from insufficient protection against CSRF attacks in the Script Console of Liferay Portal versions 7.0.0 through 7.4.3.101 and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4. This flaw allows remote attackers to execute arbitrary Groovy scripts by crafting malicious URLs or exploiting existing cross-site scripting (XSS) vulnerabilities. The potential ramifications include unauthorized access to sensitive data and the ability to manipulate the application’s behavior, leading to severe security breaches.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.102-GA102
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Script Console to trusted users only and to implement additional security measures such as CSRF tokens for sensitive operations until the patch can be applied.
Conclusion
In summary, CVE-2024-8980 represents a serious security vulnerability in Liferay Portal and Liferay DXP that requires immediate attention. By updating to the latest patched versions and implementing recommended workarounds, organizations can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-8980 is a critical vulnerability in Liferay Portal and Liferay DXP that allows attackers to exploit the Script Console through CSRF attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized execution of scripts, data breaches, and manipulation of application behavior, posing significant security risks.
Update your Maven project's pom.xml file to include the patched version of the affected packages as specified in the 'how_to_fix' section.
The CVSS score of this vulnerability is 9.6, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
