Denial of service in Liferay Enterprise Portal - #VU8547
Published: September 21, 2017
Vulnerability identifier: #VU8547
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to errors in AggregateFilter, MinifierFilter and DynamicCSSFilter components. A remote attacker can use a specially crafted URL to consume all available disk space on the system and cause denial of service (DoS) conditions.
Affected software
Liferay Enterprise Portal
Remediation
Install update from vendor's repository:
https://sourceforge.net/projects/liferay-patches/files/7.0.3%20GA4/
https://github.com/community-security-team/liferay-portal/compare/7.0.3-ga4...7.0.3-CST-7028.patch
https://sourceforge.net/projects/liferay-patches/files/7.0.3%20GA4/
https://github.com/community-security-team/liferay-portal/compare/7.0.3-ga4...7.0.3-CST-7028.patch