GitHub Advisoryadvisory · Maven

GHSA-2mx7-xvfg-fg53 Liferay Portal's account lockout does not invalidate existing user sessions

MEDIUM Published 2024-02-08 Modified 2024-10-03 Official page ↗
Aliases
CVE-2023-47798
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-384
Reviewed
2024-02-08

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.2.0, < 7.3.1 → fixed in 7.3.1 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp5 → fixed in 7.2.10.fp5

Description

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

Related

Alias · CVE (1)

  • CVE-2023-47798 Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References