BIT-liferay-2020-15839

vendorUSosv

view advisory published 2024-01-31Licence: per source

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-15839US	medium6.5	2.16% (82nd)	—	2020-09-22
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote…

references

External citations — patches, advisories, analysis.

https://issues.liferay.com/browse/LPE-17029WEB
https://issues.liferay.com/browse/LPE-17055WEB
https://portal.liferay.dev/learn/security/known-vulnerabilitiesWEB
https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119784928WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan