CVE-2021-29050

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page

8.8 HighFix available

Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Feb 21, 2024

What each source reports

CVE List Score used8.8

Record: CVE-2021-29050
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

EUVDEUVD-2021-156968.8

Record: EUVD-2021-15696
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mh9r-9pcx-rx558.8

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page

Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in the implementation for the portal services package before 5.25.0 from Liferay Portal (before 7.3.6), and Liferay DXP 7.3 before service pack 1, 7.2 before fix pack 11 allows remote attackers to accept the site's terms of use via social engineering and enticing the user to visit a malicious page.

Record: GHSA-mh9r-9pcx-rx55
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

NVD8.8

Record: CVE-2021-29050
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

OSVGHSA-mh9r-9pcx-rx558.8

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page

Record: GHSA-mh9r-9pcx-rx55
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-352
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`com.liferay.portal:com.liferay.portal.impl` Maven	before 5.25.0	5.25.0
`com.liferay.portal:release.dxp.bom` Maven	7.2.0 up to 7.2.10.fp11	7.2.10.fp11
`com.liferay.portal:com.liferay.portal.impl` Maven	before 5.25.0, plus listed versions 1.0.01.0.12.0.02.1.02.10.0 Show 45 moreShow less 2.11.02.12.02.13.02.14.02.15.02.16.02.17.02.18.02.19.02.2.02.20.02.21.02.22.02.23.02.24.02.25.02.25.12.25.22.25.32.26.02.26.12.26.22.27.02.27.12.27.22.28.02.28.12.28.22.29.02.3.02.30.02.30.12.30.22.30.32.30.42.31.02.32.02.32.12.33.02.33.12.33.22.34.02.34.12.35.02.36.0	5.25.0
`com.liferay.portal:release.dxp.bom` Maven	7.2.0 up to 7.2.10.fp11, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 8 moreShow less 7.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9	7.2.10.fp11

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29050 is a high vulnerability (CVSS 8.8) in Liferay Dxp, published February 20, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in com.liferay.portal:com.liferay.portal.impl 5.25.0.

References

This page doesn't list everything

Left out here: 1,090 versions. The JSON record has them.