IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-08-23 05:15

MODIFIED

2025-08-25 20:24

EPSS (Prob. Exploit)

0.31%

Top 76.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-23w4-rpc6-wpcc MODERATE

Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.portal.workflow.kaleo.designer.web

< 5.0.145

Fixed in: 5.0.145

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

9 versions affected

ALIASES:

GHSA-23w4-rpc6-wpcc

> HISTORIQUE DES MODIFICATIONS

Première apparition

23/08/2025 05:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:07

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui