LSV-978: Possible ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: None
• Component/s: None
• Labels: None
• CVE IDs: CVE-2022-42124
• CVSS Base Score: 2.6
• CVSS Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
• 7.3 Fix Pack Version: 4
• 7.4 Fix Pack Version: 1

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay DXP 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.