description: Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.
problem types: CWE-1333 Inefficient Regular Expression Complexity
affected:
{
defaultStatus: unaffected
product: Portal
vendor: Liferay
versions:
lessThanOrEqual: 7.4.3.76, status: affected, version: 7.4.3.48, versionType: maven
}
{
defaultStatus: unaffected
product: DXP
vendor: Liferay
versions:
lessThanOrEqual: 7.4.13.u76, status: affected, version: 7.4.13.u48, versionType: maven
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL