-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability description clearly points to the ComboServlet as the source of a denial-of-service vulnerability due to its failure to limit the number and size of files it combines. The provided commit patches all modify the com.liferay.portal.servlet.ComboServlet.java file, specifically within the doService method. The series of commits shows the evolution of a fix: first, introducing a configurable limit (combo.max.files), and then refining the logic to enforce this limit early in the request processing cycle within the doService method. The core of the vulnerability is the absence of a check on the number of requested files, which is precisely what the patches add. Therefore, the doService method is the single, clear point of vulnerability that would be exercised during an exploit.
com.liferay.portal.servlet.ComboServlet.doServiceportal-impl/src/com/liferay/portal/servlet/ComboServlet.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay.portal:com.liferay.portal.impl | maven | < 97.0.0 | 97.0.0 |