CVE-2024-26265: 
Java vulnerability analysis and mitigation

CVE-2024-26265 is a vulnerability discovered in the Image Uploader module of Liferay Portal and Liferay DXP. The vulnerability was disclosed on February 20, 2024, affecting Liferay Portal versions 7.2.0 through 7.4.3.15 and Liferay DXP versions 7.2 through 7.4. The issue allows remote authenticated users to manipulate file upload size limitations through the maxFileSize parameter (Liferay Advisory).

The vulnerability stems from the Image Uploader module's reliance on a request parameter to limit file upload sizes. The system improperly validates the maxFileSize parameter, allowing authenticated users to bypass intended file size restrictions. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by NIST with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while Liferay Inc. assessed it at 5.0 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) (NVD).

The vulnerability allows authenticated users to upload arbitrarily large files to the system's temp folder, potentially leading to disk space exhaustion and denial of service conditions (Liferay Advisory).

Fixed versions have been released to address this vulnerability. Users should upgrade to Liferay Portal 7.4.3.16, Liferay DXP 7.4 update 16, Liferay DXP 7.3 update 4, or Liferay DXP 7.2 fix pack 19 depending on their current version (Liferay Advisory).