Liferay Portal and Liferay DXP Session Parameter Handling Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Liferay Portal versions 7.0.0 through 7.4.3.21, as well as in Liferay DXP versions 7.4 GA through update 9, 7.3 GA through update 25, 7.2, 7.1, and 7.0. These versions do not properly restrict the saving of request parameters in the HTTP session. This oversight allows remote attackers to craft HTTP requests that consume system memory, creating denial-of-service conditions.

Impact

Exploitation of this vulnerability leads to increased memory consumption, causing denial-of-service conditions on the affected system.

Remediation

Users can upgrade to Liferay Portal 7.4.3.22 or Liferay DXP 7.4 Update 10, 7.3 Update 26. Instructions for downloading these versions are available on the Liferay GitHub release page.