CVE-2023-33950
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
In Liferay Portal versions 7.4.3.48 through 7.4.3.76 and Liferay DXP updates 48 through 76, there is a vulnerability to ReDoS attacks through the use of regular expressions as patterns. Remote attackers can exploit this flaw to consume excessive server resources via crafted request URLs.
Risk Assessment
Organizations may experience significant server performance issues, potentially leading to service availability disruptions. Attackers could leverage this vulnerability to conduct DoS attacks.
Recommendation
It is recommended to update Liferay Portal and Liferay DXP to the latest versions that address this vulnerability. Additionally, review and limit the use of regular expressions in pattern configurations.
Original NVD description (English source)
Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.