Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-25143

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older un

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Liferay

Description

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Liferay DXP

Default version status: unknown

  • 7.3.10 to ≤ 7.3.10-dxp-2affected
  • 7.2.10 to ≤ 7.2.10-dxp-12affected

Liferay Portal

Default version status: unknown

  • 7.2.0 to ≤ 7.3.6affected

References