Description
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Remediation
References
Related Vulnerabilities
WordPress Plugin eBay Feeds for WordPress Cross-Site Scripting (1.0)
WordPress Plugin WP Job Manager Cross-Site Scripting (1.26.1)
WordPress Plugin WP Frontend Profile Security Bypass (1.2.1)
WordPress Plugin Rich Reviews Multiple Vulnerabilities (1.7.3)
Moodle Incorrect Authorization Vulnerability (CVE-2025-26532)