Lucene search

MitreCVE-2022-25146

HistoryMar 03, 2022 - 12:15 a.m.

CVE-2022-25146

2022-03-0300:15:08

CWE-346

mitre

web.nvd.nist.gov

cve-2022-25146

remote app module

liferay portal

liferay dxp

csrf token

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.

Affected configurations

Nvd

Node

liferaydigital_experience_platformRange≤7.4

liferayliferay_portalRange7.4.3.4–7.4.3.9

VendorProductVersionCPE
liferaydigital_experience_platform*cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*
liferayliferay_portal*cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liferay	digital_experience_platform	*	cpe:2.3:a:liferay:digital_experience_platform::::::::
liferay	liferay_portal	*	cpe:2.3:a:liferay:liferay_portal::::::::

References

liferay.com

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps

www.securitum.pl

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

Related for CVE-2022-25146