GHSA-c7f6-4vx5-4263MediumCVSS 6.5

Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP

Published
February 10, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-15839 →

📋 Description

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

🎯 Affected products2

  • maven/com.liferay.portal:release.dxp.bom:<= 7.1.10.fp17
  • maven/com.liferay.portal:release.dxp.bom:>= 7.2.1, <= 7.2.10.fp5

🔗 References (6)