Description
The vulnerable code can bypass the Captcha check in Liferay Portal and Liferay DXP and then attackers can run scripts in the Gogo shell
Severity
6.9 (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N)
Affected Version(s)
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q1.0 through 2025.Q1.15
- Liferay DXP 2024.Q4.0 through 2024.Q4.7
- Liferay DXP 2024.Q3.0 through 2024.Q3.13
- Liferay DXP 2024.Q2.0 through 2024.Q2.13
- Liferay DXP 2024.Q1.1 through 2024.Q1.19
- Liferay DXP 7.4 update 80 through update 92
Fixed Version(s)
- Liferay Portal fixed on master branch
- Liferay DXP 2025.Q2.0
Acknowledgments
This issue was reported by Gareth Catterall, AnchorSec security team
Publication date: Mon, 12 May 2025 18:38:00 +0000