Cross-site Request Forgery (CSRF)

liferay is vulnerable to cross-site request forgery. The vulnerability exists due to the module is not validating the origin of the event message in the fetch.es.js file allowing attackers to pull out the CSRF token via a crafted event message...