CVE-2023-47798
Assigner: Liferay
Published: 2024-02-08T02:55:43.923Z
State: PUBLISHED
affected: defaultStatus: unknown
product: Portal
vendor: Liferay
versions: lessThanOrEqual: 7.3.0
status: affected
version: 7.2.0
versionType: maven
defaultStatus: unknown
product: DXP
vendor: Liferay
versions: lessThanOrEqual: 7.2.10-dxp-4
status: affected
version: 7.2.10
versionType: maven
descriptions: supportingMedia: base64: no
type: text/html
value: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
value: Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsupported versions does not invalidate existing user sessions, which allows remote authenticated users to remain authenticated after an account has been locked.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-384
description: CWE-384 Session Fixation
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev