-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:com.liferay.portal.kernel | maven | < 38.0.0 | 38.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2025-3526 in Liferay Portal allows remote attackers to cause a Denial of Service (DoS) by consuming system memory. This is due to the SessionClicks utility not adequately restricting the saving of request parameters into the HTTP session.
The analysis of the provided patches (429834b7, b40fe110e, d9108a12) reveals that modifications were made to com.liferay.portal.kernel.util.SessionClicks.java. Specifically, two overloaded put methods were identified as vulnerable. These methods are responsible for storing data in the HTTP session or session-backed portal preferences.
com.liferay.portal.kernel.util.SessionClicks.put(HttpSession httpSession, String namespace, String key, String value): Prior to the patch (evidenced by commit 429834b7), this method directly called httpSession.setAttribute(sessionKey, value) without any checks on the size of the key or value, or the total number of attributes already in the session. The patch introduced these crucial checks.
com.liferay.portal.kernel.util.SessionClicks.put(HttpServletRequest httpServletRequest, String namespace, String key, String value): Similarly, this method, which uses portalPreferences.setValue(...), lacked sufficient restrictions. The refactoring in commit d9108a12 introduced helper methods (_isValidKeyValue and _isValidSize) to enforce these limits, indicating their absence or insufficiency in the vulnerable versions.
An attacker could exploit this by sending crafted HTTP requests with numerous or very large parameters. These parameters would be processed by one of the put methods, leading to an uncontrolled increase in session data size. Over time, this would exhaust available server memory, resulting in a DoS condition. The identified functions are the entry points where this malicious input is processed and stored without proper safeguards in the vulnerable versions.