CVE-2022-25146
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Remote App module in Liferay Portal and Liferay DXP does not verify the origin of event messages, allowing attackers to steal the CSRF token via a crafted message.
Risk Assessment
An attacker can exfiltrate the CSRF token, enabling Cross-Site Request Forgery (CSRF) attacks in the user's session context, potentially leading to unauthorized actions.
Recommendation
Immediately update Liferay Portal to version 7.4.3.9 or later and Liferay DXP to version 7.4 with update 5 or later.
Original NVD description (English source)
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.