CVE-2025-3526: High severity Liferay Digital Experience Platform vulnerability
SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3526?
CVE-2025-3526 has a high severity rating due to its potential to lead to denial of service by consuming system memory.
How do I fix CVE-2025-3526?
To resolve CVE-2025-3526, you should upgrade to Liferay Portal 7.4.3.22 or any later version that addresses this vulnerability.
What versions are affected by CVE-2025-3526?
CVE-2025-3526 affects Liferay Portal versions 7.0.0 through 7.4.3.21, along with multiple versions of Liferay DXP.
What are the risks associated with CVE-2025-3526?
The risks associated with CVE-2025-3526 include the potential for remote attackers to exploit the vulnerability, leading to service disruption.
Can CVE-2025-3526 be exploited without authentication?
Yes, CVE-2025-3526 can be exploited by remote attackers without the need for authentication.