PT-2022-17098 · Liferay · Liferay Dxp +1

🗓️ 02 Mar 2022 00:00:00Reported by Positive TechnologiesType

Remote App module does not verify event origin, risk of cross site forgery token exfiltration; update affected Liferay Portal and DXP versions.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2022-25146	3 Mar 202200:15	–	attackerkb
CNNVD	多款Liferay产品访问控制错误漏洞	2 Mar 202200:00	–	cnnvd
CNVD	Liferay Portal Information Disclosure Vulnerability (CNVD-2022-19509)	4 Mar 202200:00	–	cnvd
CVE	CVE-2022-25146	2 Mar 202223:28	–	cve
Cvelist	CVE-2022-25146	2 Mar 202223:28	–	cvelist
EUVD	EUVD-2022-29889	3 Oct 202520:07	–	euvd
Github Security Blog	Liferay Portal and Liferay DXP fails to check origin of event messages	4 Mar 202200:00	–	github
NCSC	Vulnerability fixed in Liferay portal	3 Mar 202200:00	–	ncsc
NVD	CVE-2022-25146	3 Mar 202200:15	–	nvd
OSV	BIT-LIFERAY-2022-25146	31 Jan 202415:21	–	osv

Source	Link
osv	www.osv.dev/vulnerability/BIT-liferay-2022-25146
osv	www.osv.dev/vulnerability/GHSA-ghw5-998m-vw4w
liferay	www.liferay.com/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-25146
portal	www.portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps
github	www.github.com/liferay/liferay-portal
github	www.github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
liferay	www.liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps
securitum	www.securitum.pl/

31 Jan 2024 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.3

CVSS 25

EPSS0.0014