Lucene search

GoogleOSV:GHSA-2MX7-XVFG-FG53

HistoryFeb 08, 2024 - 3:32 a.m.

Liferay Portal's account lockout does not invalidate existing user sessions

2024-02-0803:32:45

Google

osv.dev

liferay portal

account lockout

user sessions

remote authenticated users

security vulnerability

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

CPENameOperatorVersion
com.liferay.portal:release.portal.bomeq7.3.0-1
com.liferay.portal:release.dxp.bomeq7.2.10.fp1
com.liferay.portal:release.dxp.bomeq7.2.10.fp1-1
com.liferay.portal:release.dxp.bomeq7.2.10.fp3
com.liferay.portal:release.dxp.bomeq7.2.1
com.liferay.portal:release.dxp.bomeq7.2.10
com.liferay.portal:release.portal.bomeq7.3.0
com.liferay.portal:release.dxp.bomeq7.2.10.fp4
com.liferay.portal:release.portal.bomeq7.2.1
com.liferay.portal:release.dxp.bomeq7.2.10.fp2

Name	Operator	Version
com.liferay.portal:release.portal.bom	eq	7.3.0-1
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp1
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp1-1
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp3
com.liferay.portal:release.dxp.bom	eq	7.2.1
com.liferay.portal:release.dxp.bom	eq	7.2.10
com.liferay.portal:release.portal.bom	eq	7.3.0
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp4
com.liferay.portal:release.portal.bom	eq	7.2.1
com.liferay.portal:release.dxp.bom	eq	7.2.10.fp2

Rows per page:

1-10 of 121

References

github.com/liferay/liferay-portal

liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798

nvd.nist.gov/vuln/detail/CVE-2023-47798

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for OSV:GHSA-2MX7-XVFG-FG53