-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:release.portal.bom | maven | >= 7.4.3.0, <= 7.4.3.132 | |
| com.liferay.portal:release.dxp.bom | maven | >= 2025.Q1.0, <= 2025.Q1.8 | 2025.Q1.9 |
| com.liferay.portal:release.dxp.bom | maven | >= 2024.Q4.0, <= 2024.Q4.7 | |
| com.liferay.portal:release.dxp.bom | maven | >= 2024.Q3.0, <= 2024.Q3.13 | |
| com.liferay.portal:release.dxp.bom | maven | >= 2024.Q2.0, <= 2024.Q2.13 | |
| com.liferay.portal:release.dxp.bom | maven | >= 2024.Q1.0, <= 2024.Q1.16 | 2024.Q1.17 |
| com.liferay.portal:release.dxp.bom | maven | <= 7.4.13.u92 | |
| com.liferay:com.liferay.frontend.taglib | maven | < 13.10.0 | 13.10.0 |
| com.liferay:com.liferay.image.uploader.web | maven | < 5.0.56 | 5.0.56 |
| com.liferay:com.liferay.users.admin.web | maven | < 11.0.27 | 11.0.27 |
| com.liferay:com.liferay.account.admin.web | maven | < 2.0.138 | 2.0.138 |
JavaJavaMiggo AIRoot Cause AnalysisThe analysis of the security vulnerability indicates a flaw in the file upload size validation process within Liferay Portal. The vulnerability, as described, allows a user to upload a profile picture exceeding the 300kb limit, potentially causing a Denial of Service. The provided commit ab8932bee29df7df377c468f662d55e624d9390d directly addresses this issue. The core of the vulnerability is located in the com.liferay.image.uploader.web.internal.util.UploadImageUtil.getMaxFileSize method. Before the patch, this method determined the maximum file size based on the currentLogoURL parameter, which was an unreliable way to identify the type of upload. An attacker could bypass this check, leading to the upload of a large file. The patch rectifies this by introducing a new type parameter in the request. This parameter is explicitly set in the user interface (JSP files) when a user is uploading a profile or organization picture. The getMaxFileSize method was updated to check for this type parameter, making the validation logic more robust and directly tied to the upload context. Therefore, the getMaxFileSize function is the primary vulnerable function, as it contained the flawed logic that was exploited.
Ongoing coverage of React2Shell