PT-2025-36625 · Maven · Com.Liferay:Com.Liferay.Portal.Workflow.Kaleo.Forms.Web

Publicado 2025-09-04 · Atualizado 2025-09-04

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older unsupported versions does not restrict the saving of request parameters in the portlet session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP request.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-J4FW-4MHR-HC45

Produtos afetados

Com.Liferay:Com.Liferay.Portal.Workflow.Kaleo.Forms.Web

Referências · 7

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/5d62db9d01005fc148297dad37f84660cd8b4a2b · Nota
• https://github.com/liferay/liferay-portal/commit/566ba7b48d6e8c62e5da71c34bb56b87183bf503 · Nota
• https://osv.dev/vulnerability/GHSA-j4fw-4mhr-hc45 · Aviso do Fabricante
• https://liferay.atlassian.net/browse/LPE-17456 · Nota
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43772 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-43772 · Nota de Segurança