CVE-2022-25146

published 2022-03-03

CVE-2022-25146: The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event…

medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
liferay	digital_experience_platform	<= 7.4	—
liferay	liferay_portal	>= 7.4.3.4 < 7.4.3.9	7.4.3.9

CWE-346