GitHub Advisoryadvisory · Maven

GHSA-chrc-q6v3-jfv8 Liferay Portal has Inefficient Regular Expression

MEDIUM Published 2023-05-24 Modified 2023-05-24 Official page ↗
Aliases
CVE-2023-33950
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2023-05-24

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.3.48, < 7.4.3.77 → fixed in 7.4.3.77

Description

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

Related

Alias · CVE (1)

  • CVE-2023-33950 Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References