Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP

2022-02-1020:46:21

Google

osv.dev

0.002 Low

EPSS

Percentile

61.0%

JSON

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

CPENameOperatorVersion
com.liferay.portal:release.dxp.bomeq7.0.10.fp82
com.liferay.portal:release.dxp.bomeq7.0.10.fp80
com.liferay.portal:release.dxp.bomeq7.1.10.fp2
com.liferay.portal:release.dxp.bomeq7.0.10.fp97
com.liferay.portal:release.dxp.bomeq7.0.10.fp63
com.liferay.portal:release.dxp.bomeq7.0.10.fp68
com.liferay.portal:release.dxp.bomeq7.0.10.fp94
com.liferay.portal:release.dxp.bomeq7.0.10.fp74
com.liferay.portal:release.dxp.bomeq7.0.10.fp87
com.liferay.portal:release.dxp.bomeq7.0.10.fp65

Name	Operator	Version
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp82
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp80
com.liferay.portal:release.dxp.bom	eq	7.1.10.fp2
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp97
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp63
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp68
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp94
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp74
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp87
com.liferay.portal:release.dxp.bom	eq	7.0.10.fp65