| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay.portal:release.dxp.bom | < 7.4.13.u5 | 7.4.13.u5 |
| com.liferay:com.liferay.remote.app.web | < 2.0.21 | 2.0.21 |
| digital experience platform | ≤ 7.4 | |
| liferay portal | ≥ 7.4.3.4, < 7.4.3.9 | 7.4.3.9 |
The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free