description: The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
defaultStatus: unknown
product: DXP
vendor: Liferay
versions:
lessThanOrEqual: 7.3.10-dxp-2, status: affected, version: 7.3.10, versionType: maven
lessThanOrEqual: 7.2.10-dxp-12, status: affected, version: 7.2.10, versionType: maven
}
{
defaultStatus: unknown
product: Portal
vendor: Liferay
versions:
lessThanOrEqual: 7.3.6, status: affected, version: 7.2.0, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL