Description
Liferay Portal and Liferay DXP allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.
Severity
5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)
Affected Version(s)
- Liferay Portal 7.4.0 through 7.4.3.132
- Liferay DXP 2025.Q1.0 through 2025.Q1.1
- Liferay DXP 2024.Q4.0 through 2024.Q4.7
- Liferay DXP 2024.Q3.1 through 2024.Q3.13
- Liferay DXP 2024.Q2.0 through 2024.Q2.12
- Liferay DXP 2024.Q1.1 through 2024.Q1.19
- Liferay DXP 7.4
Fixed Version(s)
- Liferay Portal fixed on master branch
- Liferay DXP 2025.Q2.0
- Liferay DXP 2025.Q1.2
Publication date: Mon, 17 Mar 2025 18:46:00 +0000