CVE-2022-25146

—

CVSS 3.1

5.3 medium

EPSS

<1%p38

Published

Mar 3, 2022 (Mar 3, 2022)

Modified

Jul 9, 2026

Description

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

Vendors: liferay
Products: digital experience platform, liferay portal
Weakness: CWE-346
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.