CVE-2023-33950: CVE-2023-33950 ReDoS vulnerability with Pattern Redirects - Liferay

This website uses cookies to ensure you get the best experience. Learn More.

Accept

• Ask
• Blogs
• Download
• Feedback
• Help
• Learn
• Projects
• /dev/24
• Log In

Known Vulnerabilities

• Overview
• Reporting Security Issues
• Known Vulnerabilities
• Hall of Fame

Releases

• Liferay Portal 7.4

• Liferay Portal 7.3

• Liferay Portal 7.2

• Liferay Portal 7.1

• Liferay Portal 7.0

• Liferay Portal 6.2 CE

• Liferay Faces

• Liferay DXP 7.4

• Liferay DXP 7.3

• Liferay DXP 7.2

• LIferay DXP 7.1

• LIferay DXP 7.0

CVE-2023-33950 ReDoS vulnerability with Pattern Redirects

Description

Pattern Redirects in Liferay Portal and Liferay DXP allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.

Severity

6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Version(s)

• Liferay DXP 7.4 update 48 through 76
• Liferay Portal 7.4.3.48 - 7.4.3.76

Fixed Version(s)

• Liferay DXP 7.4 update 77
• Liferay Portal 7.4.3.77

Publication date: Wed, 24 May 2023 07:00:00 +0000

Security advisories for Liferay’s enterprise offerings (e.g., Liferay DXP) are only listed here since 2023. Historial advisories are availabe in the Help Center.