Liferay Portal and DXP Kaleo Forms Admin Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Kaleo Forms Admin component of Liferay Portal versions 7.0.0 to 7.4.3.4, as well as Liferay DXP versions 7.4 GA, 7.3 GA through update 27, and older unsupported versions. The vulnerability arises because the application does not properly restrict the saving of request parameters in the portlet session. This oversight allows remote attackers to craft HTTP requests that consume system memory, leading to denial-of-service conditions.

Impact

Exploitation of this vulnerability can cause excessive memory consumption, resulting in denial-of-service conditions where the system becomes unresponsive or unavailable.

Remediation

Users can upgrade to Liferay Portal 7.4.3.5, Liferay DXP 7.4 update 1, or Liferay DXP 7.3 update 28 to address this vulnerability.