Liferay Portal and DXP Unchecked Input Vulnerability in XML-RPC Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.111, older unsupported versions, and Liferay DXP versions 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions. This vulnerability arises from unchecked input for loop conditions in XML-RPC, allowing remote attackers to craft requests that disrupt service.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Remediation

Users can upgrade to Liferay Portal 7.4.3.112 or Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, or 7.3 U36 to address this vulnerability.