GitHub Advisoryadvisory · Maven

GHSA-23w4-rpc6-wpcc Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet

MEDIUM Published 2025-08-23 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43764
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.workflow.kaleo.designer.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N
Weaknesses
CWE-1333
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.portal.workflow.kaleo.designer.web: < 5.0.145 → fixed in 5.0.145

Description

Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time.

Related

Alias · CVE (1)

  • CVE-2025-43764 Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References