~ / search / GHSA-c7f6-4vx5-4263

GHSA-c7f6-4vx5-4263

Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15839

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay.portal:release.dxp.bom < 7.1.10.fp18 7.1.10.fp18
Maven com.liferay.portal:release.dxp.bom >= 7.2.1, < 7.2.10.fp6 7.2.10.fp6

Details

As written in the advisory (Markdown source, shown as plain text).

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

References

External links from the advisory. They lead to third-party sites.