CVE-2024-38002

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-38016.1Sites managed in S@M CMS (Concept Intermedia) might be vulnerable to Reflected XSS via including scripts in one of GET header parameters.  OCVE-2024-380108.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380118.0Secure Boot Security Feature Bypass VulnerabilityCVE-2024-380136.7Microsoft Windows Server Backup Elevation of Privilege VulnerabilityCVE-2024-380147.8Windows Installer Elevation of Privilege VulnerabilityCVE-2024-380157.5Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityCVE-2024-380167.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2024-380175.5Microsoft Message Queuing Information Disclosure VulnerabilityCVE-2024-380188.8Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2024-380197.2Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityCVE-2024-380206.5Microsoft Outlook Spoofing VulnerabilityCVE-2024-380218.8Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-38002: High severity, CVSS 8.8 | Vulnix