CVE-2024-25143

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.0 through 7.3.6 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 13

Description The Document and Media widget in Liferay Portal does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.

Recommendations For Liferay Portal versions 7.2.0 through 7.3.6, update to a version that includes the fix for this issue. For Liferay DXP 7.3, apply service pack 3 or later. For Liferay DXP 7.2, apply fix pack 13 or later. As a temporary workaround, consider disabling the Document and Media widget until a patch is available. Restrict access to the widget to minimize the risk of exploitation.