Most recent entries from all

certfr-2025-avi-0815 — Une vulnérabilité a été découverte dans Liferay. Elle permet à un attaquant de provoquer un contournement de la politiq…

certfr-2025-avi-0815

EUVD-2026-253355

fkie_cve-2025-43819

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API

GHSA-rpx3-f938-xj5q — Liferay Portal and DXP does not properly expire sessions

Affected: Maven: com.liferay:com.liferay.saml.impl

### Summary

Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.

### Affected Versions

The following platform versions are affected:

* **Liferay Portal:** * `7.3.3.131` through `7.4.3.121` * **Liferay DXP:** * `2024.Q4.0`–`2024.Q4.3` * `2024.Q3.1`–`2024.Q3.13` * `2024.Q2.0`–`2024.Q2.13` * `2024.Q1.1`–`2024.Q1.12`

### Remediation

Update to the fixed builds and, for Maven consumers of the SAML module, upgrade `com.liferay:com.liferay.saml.impl` to **5.0.51** or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.

WID-SEC-W-2025-2118 — Liferay Portal: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Cross Site Scripting durchzuführen und Benutzerrechte erlangen.