What is GHSA-2mx7-xvfg-fg53?

GHSA-2mx7-xvfg-fg53 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal's account lockout does not invalidate existing user sessions

Which CVE IDs does GHSA-2mx7-xvfg-fg53 cover?

GHSA-2mx7-xvfg-fg53 covers the following CVE IDs: CVE-2023-47798. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2mx7-xvfg-fg53?

GHSA-2mx7-xvfg-fg53 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-2mx7-xvfg-fg53?

GHSA-2mx7-xvfg-fg53 affects 2 products, including: maven/com.liferay.portal:release.portal.bom:\u003e= 7.2.0, \u003c 7.3.1; maven/com.liferay.portal:release.dxp.bom:\u003e= 7.2.0, \u003c 7.2.10.fp5.

GHSA-2mx7-xvfg-fg53MediumCVSS 5.4

Liferay Portal's account lockout does not invalidate existing user sessions

Vendor

GitHub Security Advisories

Published

February 8, 2024

Last Modified

October 3, 2024

🔗 CVE IDs covered (1)

CVE-2023-47798 →

📋 Description

Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.

🎯 Affected products2

maven/com.liferay.portal:release.portal.bom:>= 7.2.0, < 7.3.1
maven/com.liferay.portal:release.dxp.bom:>= 7.2.0, < 7.2.10.fp5

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-47798
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798
https://github.com/advisories/GHSA-2mx7-xvfg-fg53