GHSA-2mx7-xvfg-fg53

ghsaUSosv

Liferay Portal's account lockout does not invalidate existing user sessions

view advisory published 2024-02-08Licence: CC-BY-4.0

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-47798US	medium4.6	0.31% (24th)	—	2024-02-08
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate exi…

references

External citations — patches, advisories, analysis.

https://github.com/liferay/liferay-portalPACKAGE
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-47798ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan