Description
CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2019-2983 Vulnerability (CVE-2019-2983)
PHP Out-of-bounds Read Vulnerability (CVE-2017-9227)
WordPress Plugin Companion Auto Update Multiple Vulnerabilities (3.2.0)
Moodle Insertion of Sensitive Information into Log File Vulnerability (CVE-2012-1156)
WordPress Plugin Democracy Poll Multiple Vulnerabilities (5.3.6)