IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-25 20:15

MODIFIED

2025-09-26 14:32

EPSS (Prob. Exploit)

0.34%

Top 73.0%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-hrqm-qpw9-w8rv MODERATE

Liferay Portal and DXP vulnerable to a memory leak

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.portal.vulcan.impl

< 5.0.115

Fixed in: 5.0.115

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

56 versions affected

ALIASES:

GHSA-hrqm-qpw9-w8rv

> HISTORIQUE DES MODIFICATIONS

Première apparition

25/09/2025 20:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui