GitHub Advisoryadvisory · Maven

GHSA-j4fw-4mhr-hc45 Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

HIGH Published 2025-09-04 Modified 2025-09-04 Official page ↗
Aliases
CVE-2025-43772
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.workflow.kaleo.forms.web
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2025-09-04

Affected packages

• Maven com.liferay:com.liferay.portal.workflow.kaleo.forms.web: < 5.0.29 → fixed in 5.0.29

Description

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

Related

Alias · CVE (1)

  • CVE-2025-43772 Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References