CVSS 3.1
4.6 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NCVE-2023-47798
Medium (4.6) in liferay. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.liferay.portal:release.portal.bom 7.3.1.
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWE
- CWE-384
- Published
- Modified
- Record from
- the NVD, synced
Affected
- liferay:digital_experience_platform
- liferay:liferay_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2mx7-xvfg-fg53 | Maven | com.liferay.portal:release.portal.bom | >=7.2.0 <7.3.1 | 7.3.1 |
| GHSA-2mx7-xvfg-fg53 | Maven | com.liferay.portal:release.dxp.bom | >=7.2.0 <7.2.10.fp5 | 7.2.10.fp5 |