Vulnerability · Published Feb 8, 2024 · Assigned by Liferay
CVE-2023-47798
Medium 5.4
In plain English
A medium-severity session fixation in DXP from Liferay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.liferay.portal:release.dxp.bom | 7.2.10.fp5 | GHSA-2mx7-xvfg-fg53 |
| Maven | com.liferay.portal:release.portal.bom | 7.3.1 | GHSA-2mx7-xvfg-fg53 |
Affected products (as reported)
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N