CVE-2025-43819: Medium severity Liferay portal vulnerability
Summary
Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.
Affected Versions
The following platform versions are affected:
Liferay Portal: 7.3.3.131 through 7.4.3.121 Liferay DXP: 2024.Q4.0–2024.Q4.3 2024.Q3.1–2024.Q3.13 2024.Q2.0–2024.Q2.13 2024.Q1.1–2024.Q1.12
Remediation
Update to the fixed builds and, for Maven consumers of the SAML module, upgrade com.liferay:com.liferay.saml.impl to 5.0.51 or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.
Other sources
A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43819?
CVE-2025-43819 is classified as a moderate severity vulnerability due to the potential for session reuse by remote attackers.
How do I fix CVE-2025-43819?
To fix CVE-2025-43819, ensure you update Liferay Portal and Liferay DXP to the latest patched versions.
Which versions are affected by CVE-2025-43819?
CVE-2025-43819 affects Liferay Portal versions 7.3.3.121 to 7.4.3.121 and multiple versions of Liferay DXP from 2024.Q1.1 to 2024.Q4.3.
What type of vulnerability is CVE-2025-43819?
CVE-2025-43819 is categorized as an Insufficient Session Expiration vulnerability.
Can CVE-2025-43819 be exploited by unauthenticated users?
Yes, CVE-2025-43819 can be exploited by unauthenticated remote attackers to reuse old user sessions.