Cross-site Request Forgery (CSRF)

2022-03-0400:01:17

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

liferay

vulnerability

csrf

token

validation

fetch.es.js

EPSS

0.001

Percentile

31.1%

JSON

liferay is vulnerable to cross-site request forgery. The vulnerability exists due to the module is not validating the origin of the event message in the fetch.es.js file allowing attackers to pull out the CSRF token via a crafted event message.

References

liferay.com

github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b

portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps

www.securitum.pl

EPSS

0.001

Percentile

31.1%

JSON

Related for VERACODE:34495