CVE-2021-29050 json
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page
published 2y ago modified 4mo ago also GHSA-mh9r-9pcx-rx55 , EUVD-2021-15696
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.
Patch / fix
- maven com.liferay.portal:com.liferay.portal.impl 5.25.0
- maven com.liferay.portal:release.dxp.bom 7.2.10.fp11
- liferay dxp fix pack 11, service pack 1, 7.2
- liferay portal 7.3.6
Is CVE-2021-29050 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.liferay.portal:com.liferay.portal.impl | <5.25.0 |
5.25.0 |
| maven | com.liferay.portal:release.dxp.bom | >=7.2.0, <7.2.10.fp11 |
7.2.10.fp11 |
Affected products
- liferay dxp
- liferay portal
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/liferay/liferay-portal/commit/1295dcd8173ac820e501d0e9b3bf1da97ea8b7d4
web
-
github.com
/liferay/liferay-portal/commit/f2723cb2e8dacfbd140ff5f255bb7d21a11c476d
web
-
liferay.dev
/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-29050
web
-
nvd.nist.gov
/vuln/detail/CVE-2021-29050
advisory
-
github.com
/liferay/liferay-portal
package
-
liferay.atlassian.net
/browse/LPE-17207
web
Sources
- CVE List CVE-2021-29050
- GitHub Advisory GHSA-mh9r-9pcx-rx55
- NVD CVE-2021-29050
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.