Description
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
Remediation
References
Related Vulnerabilities
WordPress Plugin One Click SSL Cross-Site Request Forgery (1.4.6)
MySQL CVE-2021-2166 Vulnerability (CVE-2021-2166)
Apache Tomcat Improper Authentication Vulnerability (CVE-2012-5886)
WordPress Plugin Welcart e-Commerce Cross-Site Scripting (2.2.3)
WordPress Plugin WooCommerce Multiple Vulnerabilities (2.3.5)