[LPS-58015] CSRF attack using uploaded flash files - Liferay Issues

Details

Type: Bug
Status: Closed
Resolution: Duplicate
Affects Version/s: 6.2.3 CE GA4
Fix Version/s: 6.0.X EE, 6.1.X EE, 6.2.X EE, 7.0.0 M5
Component/s: Security Vulnerability
Labels:
- cst-patch

Description

Flash does not strictly honor the same-origin policy. As a result, if an attacker is able to upload a malicious flash file to portal, the flash file can be used to circumvent the portal's CSRF protection.

Attachments

Activity

People

Assignee:

Samuel Kong

Reporter:

Samuel Kong

Participants of an Issue:

Samuel Kong

Recent user:

Esther Sanz

Votes:

0 Vote for this issue

Watchers:

0 Start watching this issue

Dates

Created:

18/Aug/15 11:22 PM

Updated:

02/Dec/15 4:45 AM

Resolved:

26/Aug/15 2:45 AM

Days since last comment:

3 years, 40 weeks, 1 day ago