CVE-2024-26265
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to upload arbitrarily large files to the system's temp folder by modifying the `maxFileSize` parameter.
El módulo Image Uploader en Liferay Portal 7.2.0 a 7.4.3.15 y versiones anteriores no compatibles, y Liferay DXP 7.4 antes de la actualización 16, 7.3 antes de la actualización 4, 7.2 antes del fixpack 19 y versiones anteriores no compatibles se basa en un parámetro de solicitud para limitar el tamaño de los archivos que se pueden cargar, lo que permite a los usuarios autenticados remotamente cargar archivos arbitrariamente grandes a la carpeta temporal del sistema modificando el parámetro `maxFileSize`.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-02-15 CVE Reserved
- 2024-02-20 CVE Published
- 2024-02-21 EPSS Updated
- 2024-10-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Liferay Search vendor "Liferay" | Portal Search vendor "Liferay" for product "Portal" | >= 7.2.0.0 <= 7.4.3.15 Search vendor "Liferay" for product "Portal" and version " >= 7.2.0.0 <= 7.4.3.15" | en |
Affected
| ||||||