CVE-2023-47798
First published: Thu Feb 08 2024(Updated: )
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
Credit: security@liferay.com security@liferay.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.liferay.portal:release.dxp.bom | >=7.2.0<7.2.10.fp5 | 7.2.10.fp5 |
| maven/com.liferay.portal:release.portal.bom | >=7.2.0<7.3.1 | 7.3.1 |
| Liferay DXP | <7.2 | |
| Liferay DXP | =7.2 | |
| Liferay DXP | =7.2-fix_pack_1 | |
| Liferay DXP | =7.2-fix_pack_2 | |
| Liferay DXP | =7.2-fix_pack_3 | |
| Liferay DXP | =7.2-fix_pack_4 | |
| Liferay 7.4 GA | >=7.2.0<7.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-47798?
CVE-2023-47798 is considered a high severity vulnerability due to the risk of user sessions remaining authenticated even after an account is locked.
How do I fix CVE-2023-47798?
To resolve CVE-2023-47798, upgrade to Liferay Portal 7.2.10 fix pack 5 or Liferay DXP 7.3.1 or higher.
Who is affected by CVE-2023-47798?
CVE-2023-47798 affects users of Liferay Portal versions 7.2.0 to 7.3.0 and earlier unsupported versions.
What is the impact of CVE-2023-47798?
CVE-2023-47798 allows remote authenticated users to maintain access after their accounts have been locked, posing a security risk.
Is there a workaround for CVE-2023-47798?
There are no specific known workarounds for CVE-2023-47798; upgrading to a fixed version is recommended.
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2mx7-xvfg-fg53
- alias/CVE-2023-47798
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/event
- collector/github-advisory
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- vendor/liferay
- canonical/liferay dxp
- version/liferay dxp/7.2
- version/liferay dxp/7.2-fix_pack_1
- version/liferay dxp/7.2-fix_pack_2
- version/liferay dxp/7.2-fix_pack_3
- version/liferay dxp/7.2-fix_pack_4
- canonical/liferay 7.4 ga
- version/liferay 7.4 ga/7.2.0