Cross-Site Request Forgery (CSRF)

com.liferay.layout.seo.web is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists due to the lack of validation in the backURL parameter in the layout module’s SEO configuration, which allows an attacker to inject and execute malicious code in the scripting console via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL parameter.