Description
The Remote App module in Liferay Portal through v7.4.3.8 and Liferay DXP through v7.4 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress+Microsoft Office 365/Azure AD-LOGIN Unspecified Vulnerability (11.6)
Oracle Application Server Other Vulnerability (CVE-2006-5354)
WordPress Plugin Sina Extension for Elementor Local File Inclusion (2.2.0)
Magento CVE-2019-7895 Vulnerability (CVE-2019-7895)
IBM WebSEAL Improper Restriction of XML External Entity Reference Vulnerability (CVE-2019-4707)