CVE-2021-29050 json
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
published 2024-02-20 2 y ago modified 2026-06-17 4 mo ago also GHSA-mh9r-9pcx-rx55 , EUVD-2021-15696
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.
Patch / fix
- maven com.liferay.portal:com.liferay.portal.impl 5.25.0
- maven com.liferay.portal:release.dxp.bom 7.2.10.fp11
- liferay dxp fix pack 11, service pack 1, 7.2
- liferay portal 7.3.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:com.liferay.portal.impl | <5.25.0 |
5.25.0 |
| maven | com.liferay.portal:release.dxp.bom | >=7.2.0, <7.2.10.fp11 |
7.2.10.fp11 |
Affected products
- liferay dxp
- liferay portal
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/liferay/liferay-portal/commit/1295dcd8173ac820e501d0e9b3bf1da97ea8b7d4
web
-
github.com
/liferay/liferay-portal/commit/f2723cb2e8dacfbd140ff5f255bb7d21a11c476d
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-29050
web
-
nvd.nist.gov
/vuln/detail/CVE-2021-29050
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17207
web
Sources
- CVE List CVE-2021-29050
- GitHub Advisory GHSA-mh9r-9pcx-rx55
- NVD CVE-2021-29050
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.