CVE-2024-38002
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
CVE-2024-38002- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Weakness
- CWE-862
- Updated
- 2026-11-09
EUVDEUVD-2024-37060
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
EUVD-2024-37060- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-3mfq-fp2f-vwqh
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
GHSA-3mfq-fp2f-vwqh- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-862, CWE-863
- Updated
- 2026-11-02
NVD
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
CVE-2024-38002- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862, CWE-863
- Updated
- 2026-11-09
OSV
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
CVE-2024-38002- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
OSVGHSA-3mfq-fp2f-vwqh
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
- Record
GHSA-3mfq-fp2f-vwqh- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-862, CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.3.2-ga3 up to 7.4.3.112-ga112 | 7.4.3.112-ga112 |
com.liferay.portal:release.dxp.bomMaven |
2023.Q4.0 up to 2023.Q4.6 | 2023.Q4.6 |
com.liferay.portal:release.dxp.bomMaven |
2023.Q3.1 up to 2023.Q3.9 | 2023.Q3.9 |
com.liferay.portal:release.dxp.bomMaven |
7.3-ga up to 7.3.10.u36 | 7.3.10.u36 |
com.liferay.portal:release.dxp.bomMaven |
7.4-ga up to 7.4.13.u92 | 7.4.13.u92 |
com.liferay.portal:release.portal.bomMaven |
7.3.2-ga3 up to 7.4.3.112-ga112, plus listed versions 7.3.37.3.3-17.3.47.3.57.3.6 Show 45 moreShow less7.3.77.4.07.4.17.4.1-17.4.27.4.2-17.4.3.107.4.3.1007.4.3.1017.4.3.1027.4.3.1037.4.3.1047.4.3.1057.4.3.1067.4.3.1077.4.3.117.4.3.1127.4.3.127.4.3.137.4.3.147.4.3.157.4.3.167.4.3.177.4.3.187.4.3.197.4.3.207.4.3.20-ga207.4.3.217.4.3.21-ga217.4.3.227.4.3.237.4.3.247.4.3.257.4.3.267.4.3.277.4.3.287.4.3.297.4.3.307.4.3.317.4.3.327.4.3.337.4.3.347.4.3.357.4.3.367.4.3.37 |
7.4.3.112-ga112 |
com.liferay.portal:release.dxp.bomMaven |
2023.Q4.0 up to 2023.Q4.6, plus listed versions 2023.q4.02023.q4.12023.q4.22023.q4.32023.q4.42023.q4.5 |
2023.Q4.6 |
com.liferay.portal:release.dxp.bomMaven |
2023.Q3.1 up to 2023.Q3.9, plus listed versions 2023.q3.12023.q3.22023.q3.32023.q3.42023.q3.52023.q3.62023.q3.72023.q3.8 |
2023.Q3.9 |
com.liferay.portal:release.dxp.bomMaven |
7.3-ga up to 7.3.10.u36, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp1 Show 37 moreShow less7.3.10.fp27.3.10.u107.3.10.u117.3.10.u127.3.10.u137.3.10.u147.3.10.u157.3.10.u167.3.10.u177.3.10.u187.3.10.u197.3.10.u19-17.3.10.u207.3.10.u20-17.3.10.u217.3.10.u21-17.3.10.u227.3.10.u22-17.3.10.u237.3.10.u247.3.10.u257.3.10.u267.3.10.u277.3.10.u287.3.10.u297.3.10.u307.3.10.u317.3.10.u327.3.10.u337.3.10.u347.3.10.u357.3.10.u47.3.10.u57.3.10.u67.3.10.u77.3.10.u87.3.10.u9 |
7.3.10.u36 |
com.liferay.portal:release.dxp.bomMaven |
7.4-ga up to 7.4.13.u92, plus listed versions 7.4.10.ep17.4.117.4.127.4.137.4.13.u1 Show 45 moreShow less7.4.13.u107.4.13.u157.4.13.u167.4.13.u177.4.13.u187.4.13.u197.4.13.u27.4.13.u207.4.13.u217.4.13.u227.4.13.u237.4.13.u247.4.13.u257.4.13.u267.4.13.u277.4.13.u287.4.13.u297.4.13.u37.4.13.u307.4.13.u317.4.13.u327.4.13.u337.4.13.u347.4.13.u357.4.13.u367.4.13.u377.4.13.u387.4.13.u397.4.13.u47.4.13.u407.4.13.u417.4.13.u427.4.13.u437.4.13.u447.4.13.u457.4.13.u467.4.13.u477.4.13.u487.4.13.u497.4.13.u57.4.13.u507.4.13.u517.4.13.u527.4.13.u537.4.13.u54 |
7.4.13.u92 |
History
| Recorded | Changed | Sources |
|---|---|---|
| description, severity | CVE List | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38002 is a critical vulnerability (CVSS 9.3) in Liferay Dxp, published October 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.3.112-ga112.
References
Left out here: 113 versions. The JSON record has them.