CVE-2008-0563

Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2008-02-05

Last modified

2024-09-16

Weaknesses

CWE-352

Affected products

• Liferay Enterprise Portal (Liferay)

References

• http://support.liferay.com/browse/LEP-4737