IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-12 11:15

MODIFIED

2025-08-12 14:25

EPSS (Prob. Exploit)

0.29%

Top 80.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-cg99-m88x-422c MODERATE

Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.account.admin.web

< 2.0.138

Fixed in: 2.0.138

MAVEN / com.liferay:com.liferay.users.admin.web

< 11.0.27

Fixed in: 11.0.27

MAVEN / com.liferay:com.liferay.image.uploader.web

< 5.0.56

Fixed in: 5.0.56

MAVEN / com.liferay:com.liferay.frontend.taglib

< 13.10.0

Fixed in: 13.10.0