PT-2022-17098 · Liferay · Liferay Portal+1

Jakub Zoczek · Published 2022-03-02 · Updated 2024-01-31 · CVE-2022-25146

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.4 through 7.4.3.8 Liferay DXP 7.4 before update 5

Description The issue concerns the Remote App module, which fails to verify if the origin of received event messages matches the Remote App's origin. This allows attackers to potentially exfiltrate the CSRF token by sending a crafted event message.

Recommendations For Liferay Portal versions 7.4.3.4 through 7.4.3.8, update to a version outside of this range to resolve the issue. For Liferay DXP 7.4 before update 5, apply update 5 or later to fix the problem.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BIT-LIFERAY-2022-25146

CVE-2022-25146

GHSA-GHW5-998M-VW4W

Affected Products

Liferay Dxp

Liferay Portal

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-25146 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ghw5-998m-vw4w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25146 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2022-25146 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b · Note
• https://securitum.pl · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps?p_r_p_assetEntryId=121612000&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612000%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note