CVE-2022-25146
03.03.2022, 00:15
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.Enginsight
| Vendor | Product | Version |
|---|---|---|
| liferay | digital_experience_platform | 𝑥 ≤ 7.4 |
| liferay | liferay_portal | 7.4.3.4 ≤ 𝑥 < 7.4.3.9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References