6.5

CVE-2022-25146 CSRF token exfiltration via Remote Apps

Description

The Remote App module in Liferay Portal 7.4.3.4 through 7.4.3.8 does not check if the origin of event messages it receives matches the origin of the remote app, which allows remote attackers to exfiltration the CSRF token by sending a crafted event message and waiting for the application to respond with the sensitive information.

Severity

6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Affected Version(s)

  • Liferay Portal 7.4.3.4 - 7.4.3.8

Fixed Version(s)

Acknowledgments

This issue was reported by Jakub Zoczek, Securitum

Publication Date: 

March 2, 2022

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!