CVE-2025-43762

MEDIUM

Liferay Digital Experience Platform - Resource Allocation Without L...

Title source: rule
STIX 2.1

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0011
EPSS Percentile 28.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (3)
com.liferay/com.liferay.dynamic.data.mapping.form.field.type 0 - 6.0.187Maven
com.liferay/com.liferay.dynamic.data.mapping.form.web 0 - 4.0.180Maven
liferay/digital_experience_platform 7.4 (48 CPE variants)
Published Aug 22, 2025
Tracked Since Feb 18, 2026