{"id":"GHSA-ghw5-998m-vw4w","summary":"Liferay Portal and Liferay DXP fails to check origin of event messages","details":"The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.","aliases":["BIT-liferay-2022-25146","CVE-2022-25146"],"modified":"2025-07-15T19:41:54.046855Z","published":"2022-03-04T00:00:19Z","database_specific":{"nvd_published_at":"2022-03-03T00:15:00Z","cwe_ids":["CWE-346"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-07-15T19:01:58Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25146"},{"type":"WEB","url":"https://github.com/liferay/liferay-portal/commit/2fe144127a1a3b4c74f47e4b760b992b997c276b"},{"type":"PACKAGE","url":"https://github.com/liferay/liferay-portal"},{"type":"WEB","url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps?p_r_p_assetEntryId=121612000&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612000%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"},{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-25146-csrf-token-exfiltration-via-remote-apps"},{"type":"WEB","url":"http://liferay.com"}],"affected":[{"package":{"name":"com.liferay:com.liferay.remote.app.web","ecosystem":"Maven","purl":"pkg:maven/com.liferay/com.liferay.remote.app.web"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.21"}]}],"versions":["2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.20","2.0.6","2.0.7","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-ghw5-998m-vw4w/GHSA-ghw5-998m-vw4w.json"}},{"package":{"name":"com.liferay.portal:release.dxp.bom","ecosystem":"Maven","purl":"pkg:maven/com.liferay.portal/release.dxp.bom"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.13.u5"}]}],"versions":["7.0.10.14","7.0.10.14-1","7.0.10.16","7.0.10.17","7.0.10.7","7.0.10.8","7.0.10.9","7.0.10.fp100","7.0.10.fp101","7.0.10.fp102","7.0.10.fp60","7.0.10.fp61","7.0.10.fp62","7.0.10.fp63","7.0.10.fp64","7.0.10.fp65","7.0.10.fp66","7.0.10.fp67","7.0.10.fp68","7.0.10.fp69","7.0.10.fp70","7.0.10.fp71","7.0.10.fp72","7.0.10.fp73","7.0.10.fp74","7.0.10.fp75","7.0.10.fp76","7.0.10.fp77","7.0.10.fp78","7.0.10.fp79","7.0.10.fp80","7.0.10.fp81","7.0.10.fp82","7.0.10.fp83","7.0.10.fp84","7.0.10.fp85","7.0.10.fp85-1","7.0.10.fp86","7.0.10.fp86-1","7.0.10.fp87","7.0.10.fp87-1","7.0.10.fp88","7.0.10.fp89","7.0.10.fp90","7.0.10.fp91","7.0.10.fp92","7.0.10.fp94","7.0.10.fp94-1","7.0.10.fp95","7.0.10.fp95-1","7.0.10.fp95-2","7.0.10.fp97","7.0.10.fp98","7.1.10","7.1.10.1","7.1.10.3","7.1.10.4","7.1.10.5","7.1.10.6","7.1.10.7","7.1.10.8","7.1.10.fp1","7.1.10.fp10","7.1.10.fp11","7.1.10.fp12","7.1.10.fp13","7.1.10.fp14","7.1.10.fp15","7.1.10.fp16","7.1.10.fp17","7.1.10.fp18","7.1.10.fp19","7.1.10.fp2","7.1.10.fp20","7.1.10.fp22","7.1.10.fp24","7.1.10.fp25","7.1.10.fp26","7.1.10.fp27","7.1.10.fp28","7.1.10.fp3","7.1.10.fp4","7.1.10.fp5","7.1.10.fp6","7.1.10.fp7","7.1.10.fp8","7.1.10.fp9","7.2.1","7.2.10","7.2.10.1","7.2.10.2","7.2.10.3","7.2.10.3-1","7.2.10.4","7.2.10.4-1","7.2.10.5","7.2.10.5-1","7.2.10.6","7.2.10.7","7.2.10.8","7.2.10.fp1","7.2.10.fp1-1","7.2.10.fp10","7.2.10.fp11","7.2.10.fp12","7.2.10.fp13","7.2.10.fp14","7.2.10.fp15","7.2.10.fp16","7.2.10.fp17","7.2.10.fp18","7.2.10.fp19","7.2.10.fp2","7.2.10.fp20","7.2.10.fp3","7.2.10.fp4","7.2.10.fp5","7.2.10.fp6","7.2.10.fp7","7.2.10.fp8","7.2.10.fp9","7.3.10","7.3.10.0-2","7.3.10.1","7.3.10.3","7.3.10.ep3","7.3.10.ep4","7.3.10.ep5","7.3.10.fp1","7.3.10.fp2","7.3.10.u10","7.3.10.u11","7.3.10.u12","7.3.10.u13","7.3.10.u14","7.3.10.u15","7.3.10.u16","7.3.10.u17","7.3.10.u18","7.3.10.u19","7.3.10.u19-1","7.3.10.u20","7.3.10.u20-1","7.3.10.u21","7.3.10.u21-1","7.3.10.u22","7.3.10.u22-1","7.3.10.u23","7.3.10.u24","7.3.10.u25","7.3.10.u26","7.3.10.u27","7.3.10.u28","7.3.10.u29","7.3.10.u30","7.3.10.u31","7.3.10.u32","7.3.10.u33","7.3.10.u34","7.3.10.u35","7.3.10.u36","7.3.10.u4","7.3.10.u5","7.3.10.u6","7.3.10.u7","7.3.10.u8","7.3.10.u9","7.4.10.ep1","7.4.11","7.4.12","7.4.13","7.4.13.u1","7.4.13.u2","7.4.13.u3","7.4.13.u4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-ghw5-998m-vw4w/GHSA-ghw5-998m-vw4w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}