IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-24 02:15

MODIFIED

2025-09-24 18:11

EPSS (Prob. Exploit)

0.18%

Top 92.7%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-01

> DESCRIPTION

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-rpx3-f938-xj5q MODERATE

Liferay Portal and DXP does not properly expire sessions

AFFECTED PACKAGES:

MAVEN / com.liferay:com.liferay.saml.impl

< 5.0.51

Fixed in: 5.0.51

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

ALIASES:

GHSA-rpx3-f938-xj5q

> HISTORIQUE DES MODIFICATIONS

Première apparition

24/09/2025 02:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui