GitHub Advisory DatabaseGHSA-87M3-6QJ3-P3XHLiferay Portal denial of service (memory consumption)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.2%
The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | lt | 7.3.7 |
References
github.com/advisories/GHSA-87m3-6qj3-p3xh
github.com/liferay/liferay-portal/commit/29b73b9b896c7d44fb5d1800a402698c303d1cf6
github.com/liferay/liferay-portal/commit/4381c10ad0722b3b00c3e3567b68538ab0994145
github.com/liferay/liferay-portal/releases/tag/7.3.7-ga8
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25143
nvd.nist.gov/vuln/detail/CVE-2024-25143
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.2%