---
id: CVE-2024-38002
title: >-
  The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay
  DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through
  update 92 and 7.3 GA through update 36 does not properly check user
  permissions be…
summary: >-
  The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay
  DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through
  update 92 and 7.3 GA through update 36 does not properly check user
  permissions be…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: Liferay
product: Portal
affected:
  - Portal >= 7.3.2 <= 7.3.7
  - Portal >= 7.4.0 <= 7.4.3.111
  - DXP >= 7.3.10 <= 7.3.10-u36
  - DXP >= 7.4.13 <= 7.4.13-u92
  - DXP >= 2023.Q3.1 <= 2023.Q3.8
  - DXP >= 2023.Q4.0 <= 2023.Q4.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-08-21T00:00:00+00:00'
published: '2024-10-22'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T09:10:15.972Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-38002'
references:
  - url: >-
      https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-38002
tags:
  - cve.org
epss: 0.00648
epssPercentile: 0.51334
ingestedAt: '2026-11-09T10:09:22.809Z'
---

## Overview

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote non-authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.

## Affected

- `Portal >= 7.3.2 <= 7.3.7`
- `Portal >= 7.4.0 <= 7.4.3.111`
- `DXP >= 7.3.10 <= 7.3.10-u36`
- `DXP >= 7.4.13 <= 7.4.13-u92`
- `DXP >= 2023.Q3.1 <= 2023.Q3.8`
- `DXP >= 2023.Q4.0 <= 2023.Q4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.