1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-C7F6-4VX5-4263

[MAVEN:GHSA-C7F6-4VX5-4263] Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP

Severity Moderate
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

Package Affected Version
pkg:maven/com.liferay.portal/release.dxp.bom >= 7.2.1, <= 7.2.10.fp5
pkg:maven/com.liferay.portal/release.dxp.bom <= 7.1.10.fp17
Package Fixed Version
pkg:maven/com.liferay.portal/release.dxp.bom = 7.2.10.fp6
pkg:maven/com.liferay.portal/release.dxp.bom = 7.1.10.fp18
ID
MAVEN:GHSA-C7F6-4VX5-4263
Severity
moderate
URL
https://github.com/advisories/GHSA-c7f6-4vx5-4263
Published
2022-02-10T20:46:21
(2 years ago)
Modified
2023-02-01T05:05:40
(19 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/com.liferay.portal/release.dxp.bom com.liferay.portal release.dxp.bom >= 7.2.1 <= 7.2.10.fp5
Fixed pkg:maven/com.liferay.portal/release.dxp.bom com.liferay.portal release.dxp.bom = 7.2.10.fp6
Affected pkg:maven/com.liferay.portal/release.dxp.bom com.liferay.portal release.dxp.bom <= 7.1.10.fp17
Fixed pkg:maven/com.liferay.portal/release.dxp.bom com.liferay.portal release.dxp.bom = 7.1.10.fp18
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date