CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.3. It may be remotely exploitable.
CVE
CVE-2022-25146
Severity
MEDIUM
CVSS
5.3
EPSS
0.46%
Original NVD Description
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Related CVEs
Other vulnerabilities affecting the same vendor(s)