GHSA-vgqx-447m-wvcj

Source

https://github.com/advisories/GHSA-vgqx-447m-wvcj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-vgqx-447m-wvcj/GHSA-vgqx-447m-wvcj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vgqx-447m-wvcj

Aliases

CVE-2025-62260

Published

2025-10-28T00:31:26Z

Modified

2025-11-15T03:25:45Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Liferay Portal Vulnerable to DoS via Crafted Headless API Request

Details

Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-29T10:44:49Z",
    "nvd_published_at":  "2025-10-27T22:15:41Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / com.liferay.portal:release.portal.bom

Package

Name: com.liferay.portal:release.portal.bom; View open source insights on deps.dev
Purl: pkg:maven/com.liferay.portal/release.portal.bom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.4.0-ga1

Fixed

7.4.3.100

Affected versions

7.*

7.4.1

7.4.1-1

7.4.2

7.4.2-1

7.4.3.4

7.4.3.5

7.4.3.6

7.4.3.7

7.4.3.8

7.4.3.9

7.4.3.10

7.4.3.11

7.4.3.12

7.4.3.13

7.4.3.14

7.4.3.15

7.4.3.16

7.4.3.17

7.4.3.18

7.4.3.19

7.4.3.20

7.4.3.20-ga20

7.4.3.21

7.4.3.21-ga21

7.4.3.22

7.4.3.23

7.4.3.24

7.4.3.25

7.4.3.26

7.4.3.27

7.4.3.28

7.4.3.29

7.4.3.30

7.4.3.31

7.4.3.32

7.4.3.33

7.4.3.34

7.4.3.35

7.4.3.36

7.4.3.37

7.4.3.38

7.4.3.39

7.4.3.40

7.4.3.41

7.4.3.42

7.4.3.43

7.4.3.44

7.4.3.45

7.4.3.46

7.4.3.47

7.4.3.48

7.4.3.49

7.4.3.50

7.4.3.51

7.4.3.52

7.4.3.53

7.4.3.54

7.4.3.55

7.4.3.56

7.4.3.57

7.4.3.58

7.4.3.59

7.4.3.60

7.4.3.60-ga60

7.4.3.61

7.4.3.61-ga61

7.4.3.62

7.4.3.63

7.4.3.64

7.4.3.65

7.4.3.66

7.4.3.67

7.4.3.68

7.4.3.69

7.4.3.70

7.4.3.71

7.4.3.72

7.4.3.73

7.4.3.74

7.4.3.75

7.4.3.76

7.4.3.77

7.4.3.78

7.4.3.79

7.4.3.80

7.4.3.81

7.4.3.82

7.4.3.83

7.4.3.84

7.4.3.85

7.4.3.85-ga85

7.4.3.86

7.4.3.87

7.4.3.88

7.4.3.89

7.4.3.90

7.4.3.91

7.4.3.92

7.4.3.93

7.4.3.94

7.4.3.95

7.4.3.95-1

7.4.3.96

7.4.3.97

7.4.3.98

7.4.3.99

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-vgqx-447m-wvcj/GHSA-vgqx-447m-wvcj.json"