Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jaHJjLXE2djMtamZ2OM4AAzdZ

Liferay Portal has Inefficient Regular Expression

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

Permalink: https://github.com/advisories/GHSA-chrc-q6v3-jfv8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jaHJjLXE2djMtamZ2OM4AAzdZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 6 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-chrc-q6v3-jfv8, CVE-2023-33950
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-33950
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950
• https://github.com/advisories/GHSA-chrc-q6v3-jfv8

Blast Radius: 9.9

Affected Packages