What is GHSA-chrc-q6v3-jfv8?

GHSA-chrc-q6v3-jfv8 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal has Inefficient Regular Expression

Which CVE IDs does GHSA-chrc-q6v3-jfv8 cover?

GHSA-chrc-q6v3-jfv8 covers the following CVE IDs: CVE-2023-33950. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-chrc-q6v3-jfv8?

GHSA-chrc-q6v3-jfv8 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-chrc-q6v3-jfv8?

GHSA-chrc-q6v3-jfv8 affects 1 product, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.4.3.48, \u003c 7.4.3.77.

GHSA-chrc-q6v3-jfv8MediumCVSS 6.5

Liferay Portal has Inefficient Regular Expression

Vendor

GitHub Security Advisories

Published

May 24, 2023

Last Modified

November 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-33950 →

📋 Description

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

🎯 Affected products1

maven/com.liferay.portal:release.portal.bom:>= 7.4.3.48, < 7.4.3.77

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-33950
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950
https://github.com/advisories/GHSA-chrc-q6v3-jfv8