PT-2024-21318 · Liferay · Liferay Portal+1

Published 2024-02-20 · Updated 2024-10-02 · CVE-2024-26265

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.4.3.15 Liferay DXP 7.4 before update 16 Liferay DXP 7.3 before update 4 Liferay DXP 7.2 before fix pack 19

Description The Image Uploader module relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the maxFileSize parameter.

Recommendations For Liferay Portal versions 7.2.0 through 7.4.3.15, update to a version that includes the fix for this issue. For Liferay DXP 7.4 before update 16, apply update 16 to resolve the issue. For Liferay DXP 7.3 before update 4, apply update 4 to resolve the issue. For Liferay DXP 7.2 before fix pack 19, apply fix pack 19 to resolve the issue. As a temporary workaround, consider restricting access to the Image Uploader module until a patch is available. Avoid using the maxFileSize parameter in the affected module until the issue is resolved.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-26265

GHSA-29XX-FHFF-36M7

Affected Products

Liferay Dxp

Liferay Portal

References · 7

• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26265 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26265 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29xx-fhff-36m7 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://twitter.com/CVEnew/status/1759930486888022122 · Twitter Post
• https://t.me/cvenotify/71969 · Telegram Post