CVE-2025-3602 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

Reserved 2025-04-14 | Published 2025-06-16 | Updated 2025-06-16 | Assigner Liferay

HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-400 Uncontrolled Resource Consumption

Product status

Default status

unaffected

7.4.0

affected

Default status

unaffected

7.2.10-dxp-8

affected

7.3.10

affected

7.4.13

affected

2023.Q3.1

affected

References

liferay.dev/.../-/asset_publisher/jekt/content/CVE-2025-3602

cve.org (CVE-2025-3602)

nvd.nist.gov (CVE-2025-3602)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-3602

Support options

Helpdesk Chat, Email, Knowledgebase