Description

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

Remediation

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33950

Related Vulnerabilities

CVE-2023-27096 Vulnerability in maven package cn.hippo4j:hippo4j-all

CVE-2014-0193 Vulnerability in maven package io.netty:netty-codec-http

CVE-2018-11804 Vulnerability in maven package org.apache.spark:spark-core

CVE-2020-2226 Vulnerability in maven package org.jenkins-ci.plugins:matrix-project

CVE-2023-45135 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-skin-resources

Severity

High

Classification

CWE-1333 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Vendor Advisory