Description
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.liferay:com.liferay.remote.app.web | < 2.0.21 | 2.0.21 | GHSA-ghw5-998m-vw4w |
| Maven | com.liferay.portal:release.dxp.bom | < 7.4.13.u5 | 7.4.13.u5 | GHSA-ghw5-998m-vw4w |