CVE-2024-25143: 
Java vulnerability analysis and mitigation

CVE-2024-25143 is a vulnerability in the Document and Media widget affecting Liferay Portal versions 7.2.0 through 7.3.6 and Liferay DXP versions 7.3 before service pack 3 and 7.2 before fix pack 13. The vulnerability was disclosed on February 6, 2024 (Liferay Advisory).

The vulnerability stems from the Document and Media widget's failure to limit resource consumption when generating preview images. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness is categorized as CWE-770: Allocation of Resources Without Limits or Throttling (NVD).

When exploited, this vulnerability allows remote authenticated users to cause a denial of service through memory consumption by uploading crafted PNG images (Liferay Advisory).

As a workaround, administrators can remove 'png' from the list of permitted extensions that can be uploaded to Document and Media. This setting is accessible via Control Panel > Configuration > System Settings > Documents and Media > System Scope > Service > File Extensions. For permanent fixes, users should upgrade to Liferay Portal 7.3.7, Liferay DXP 7.2 fix pack 13, or Liferay DXP 7.3 fix pack 2 (Liferay Advisory).