CVE-2025-3602 — Uncontrolled Resource Consumption in DXP

CWE-400 — Uncontrolled Resource Consumption4 documents4 sources
Severity
8.7HIGHNVD
EPSS
0.5%
top 32.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay DXPLiferay PortalLiferay Digital Experience Platform+1 more
Timeline
PublishedJun 16

Description

Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.0 — 7.4.3.97
▶NVDliferay/liferay_portal7.4.0 — 7.4.3.97
▶CVEListV5liferay/dxp7.2.10-dxp-8 — dxp-20+3
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.2+3

🔴Vulnerability Details

3
CVEList
CVE-2025-3602: Liferay Portal 7↗2025-06-16
▶
GHSA
Liferay Portal does not limit the depth of a GraphQL queries↗2025-06-16
▶
OSV
Liferay Portal does not limit the depth of a GraphQL queries↗2025-06-16
▶
CVE-2025-3602 — Uncontrolled Resource Consumption | cvebase