CVE-2024-26273: 
Java vulnerability analysis and mitigation

A Cross-site request forgery (CSRF) vulnerability was discovered in the content page editor of Liferay Portal and Liferay DXP. The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.103, Liferay DXP versions 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and 7.3 update 29 through update 35. The vulnerability was disclosed on September 12, 2024, and was reported by NDIx (Liferay Advisory).

The vulnerability exists in the content page editor and specifically involves the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter. The severity of this vulnerability has been rated as HIGH with a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD).

The exploitation of this vulnerability allows remote attackers to perform multiple critical administrative actions including: changing user passwords, shutting down the server, executing arbitrary code in the scripting console, and performing other administrative actions (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal 7.4.3.104, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.3, Liferay DXP 2023.Q3.6, or Liferay DXP 7.3 Update 36 (Liferay Advisory).