CVE-2023-47798 Information

Description

Account lockout in Liferay Portal 7.2.0 through 7.3.0 and older unsupported versions and Liferay DXP 7.2 before fix pack 5 and older unsupported versions does not invalidate existing user sessions which allows remote authenticated users to remain authenticated after an account has been locked.

Reference

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47798