CVE-2021-29050: CSRF
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.
Other sources
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in the implementation for the portal services package before 5.25.0 from Liferay Portal (before 7.3.6), and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29050?
CVE-2021-29050 is classified as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2021-29050?
To fix CVE-2021-29050, upgrade to Liferay Portal version 7.3.6 or later, or Liferay DXP version 7.3 service pack 1 or later, and 7.2 fix pack 11 or later.
What systems are affected by CVE-2021-29050?
CVE-2021-29050 affects Liferay Portal versions prior to 7.3.6, Liferay DXP versions prior to 7.3 service pack 1, and prior to 7.2 fix pack 11.
What type of vulnerability is CVE-2021-29050?
CVE-2021-29050 is a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized actions to be performed on behalf of an authenticated user.
Can CVE-2021-29050 be exploited remotely?
Yes, CVE-2021-29050 can be exploited remotely by enticing users to click on a malicious link to accept terms of use.