GitHub Advisoryadvisory · Maven

GHSA-29xx-fhff-36m7 Liferay Portal vulnerable to Denial of Service

MEDIUM Published 2024-02-20 Modified 2025-01-29 Official page ↗
Aliases
CVE-2024-26265
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2024-10-02

Affected packages

• Maven com.liferay.portal:release.portal.bom: < 7.4.3.16 → fixed in 7.4.3.16

Description

The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.

Related

Alias · CVE (1)

  • CVE-2024-26265 The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16,… vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References