GitHub Advisoryadvisory · Maven

GHSA-mf3r-6m25-3867 Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session

HIGH Published 2025-06-16 Modified 2025-06-16 Official page ↗
Aliases
CVE-2025-3526
Ecosystem
Maven
Packages
com.liferay.portal:com.liferay.portal.kernel
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2025-06-16

Affected packages

• Maven com.liferay.portal:com.liferay.portal.kernel: < 38.0.0 → fixed in 38.0.0

Description

SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.

Related

Alias · CVE (1)

  • CVE-2025-3526 SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References