GitHub Advisoryadvisory · Maven

GHSA-84pp-qr92-95c9 Liferay Portal users can upload an unlimited amount of files

MEDIUM Published 2025-08-22 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43762
Ecosystem
Maven
Packages
com.liferay:com.liferay.dynamic.data.mapping.form.web, com.liferay:com.liferay.dynamic.data.mapping.form.field.type
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Weaknesses
CWE-770
Reviewed
2025-08-25

Affected packages

• Maven com.liferay:com.liferay.dynamic.data.mapping.form.web: < 4.0.180 → fixed in 4.0.180 • Maven com.liferay:com.liferay.dynamic.data.mapping.form.field.type: < 6.0.187 → fixed in 6.0.187

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

Related

Alias · CVE (1)

  • CVE-2025-43762 Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References