Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

LSV-684: CORS should not work with Portal Session authentication

Affects versions

Fix versions

7.0 Fix Pack Version

None

7.1 Fix Pack Version

None

7.2 Fix Pack Version

9

7.3 Fix Pack Version

None

7.4 Fix Pack Version

None

CVE IDs

CVSS Base Score

CVSS Vector String

Labels

Description

Liferay DXP 7.2 allows access to Cross-origin resource sharing (CORS) protected resources even if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the user email address and the current CSRF token.

Activity

Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.

Details

Assignee

Reporter

Priority

Components

Zendesk Support

Created October 28, 2020 at 4:38 PM
Updated August 2, 2021 at 12:10 AM
Resolved December 14, 2020 at 8:04 AM