IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-06-16 14:15

MODIFIED

2025-06-17 20:50

EPSS (Prob. Exploit)

0.52%

Top 55.8%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-8c26-xm99-53w7 HIGH

Liferay Portal does not limit the depth of a GraphQL queries

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.portal.vulcan.impl

< 5.0.103

Fixed in: 5.0.103

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

11 versions affected

ALIASES:

GHSA-8c26-xm99-53w7

> HISTORIQUE DES MODIFICATIONS

Première apparition

16/06/2025 14:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:05

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui