CVE advisoryCRITICAL
CVE-2024-38002
Liferay Workflow Component Allows Unauthenticated Code Execution
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A vulnerability in Liferay Portal and DXP's workflow component allows unauthenticated remote users to modify workflow definitions and execute arbitrary code via the headless API. This could impact the integrity and availability of affected systems.