description: Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
defaultStatus: unaffected
product: Portal
vendor: Liferay
versions:
lessThanOrEqual: 7.4.3.76, status: affected, version: 7.4.3.70, versionType: maven
}
{
defaultStatus: unaffected
product: DXP
vendor: Liferay
versions:
lessThanOrEqual: 7.4.13.u76, status: affected, version: 7.4.13.u70, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL