{"id":"CVE-2025-43819","aliases":["EUVD-2025-30940","GHSA-rpx3-f938-xj5q"],"status":"published","title":"Liferay Portal and DXP does not properly expire sessions","description":"A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0019,"percentile":0.08761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2025-09-24T01:37:03Z","modified":"2026-10-24T14:57:01Z","fixes":[{"ecosystem":"Maven","package":"com.liferay:com.liferay.saml.impl","fixed_in":["5.0.51"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.liferay:com.liferay.saml.impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.51"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.liferay:com.liferay.saml.impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.51"}]}],"versions":["1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","2.0.21","2.0.22","2.0.23","2.0.24","2.0.25","2.0.26","2.0.27","2.0.28","2.0.29","2.0.30","2.0.31","2.0.32","2.0.33","2.0.34","2.0.35","2.0.36","2.0.37","2.0.38","3.0.22","3.0.23","3.0.24","3.0.25","3.0.26","3.0.27","3.0.28","3.0.29","3.0.30","3.0.31","3.0.32","3.0.33","3.0.34","3.0.35","3.0.36","3.0.37","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.20","4.0.21","4.0.22","4.0.23","4.0.24","4.0.25","4.0.26","4.0.27","4.0.28","4.0.29","4.0.30","4.0.31","4.0.32","4.0.33","4.0.34","4.0.35","4.0.36","4.0.37","4.0.38","5.0.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.15","5.0.16","5.0.17","5.0.18","5.0.19","5.0.2","5.0.20","5.0.21","5.0.22","5.0.23","5.0.24","5.0.25","5.0.26","5.0.27","5.0.28","5.0.29","5.0.3","5.0.30","5.0.31","5.0.32","5.0.33","5.0.34","5.0.35","5.0.36","5.0.37","5.0.38","5.0.39","5.0.4","5.0.40","5.0.41","5.0.42","5.0.43","5.0.44","5.0.45","5.0.46","5.0.47","5.0.48","5.0.49","5.0.5","5.0.50","5.0.6","5.0.7","5.0.8","5.0.9"]}],"products":[{"vendor":"liferay","product":"digital_experience_platform"},{"vendor":"liferay","product":"dxp"},{"vendor":"liferay","product":"liferay_portal"},{"vendor":"liferay","product":"portal"}],"references":[{"url":"https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43819","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43819","tags":["advisory"]},{"url":"https://github.com/liferay/liferay-portal/commit/433dff5edae4414fdc436b49a9edb62d721c84b5","tags":["web"]},{"url":"https://github.com/liferay/liferay-portal/commit/da9105a61d788801797797a32583a4b76c902cdc","tags":["web"]},{"url":"https://liferay.atlassian.net/browse/LPE-18159","tags":["web"]},{"url":"https://osv.dev/vulnerability/GHSA-rpx3-f938-xj5q","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rpx3-f938-xj5q"},{"url":"https://github.com/liferay/liferay-portal","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-43819","description":"A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API","status":"published","published":"2025-09-24T01:37:03.396Z","modified":"2025-09-24T13:14:12.135Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:32:26.964524Z"}],"euvd":[{"id":"EUVD-2025-30940","description":"A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API","status":"published","published":"2025-09-24T01:37:03Z","modified":"2025-09-24T13:14:12Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:40.063213Z"}],"ghsa":[{"id":"GHSA-rpx3-f938-xj5q","title":"Liferay Portal and DXP does not properly expire sessions","description":"### Summary\n\nLiferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.\n\n### Affected Versions\n\nThe following platform versions are affected:\n\n*   **Liferay Portal:**  \n    *   `7.3.3.131` through `7.4.3.121`\n*   **Liferay DXP:**\n    *   `2024.Q4.0`–`2024.Q4.3`\n    *   `2024.Q3.1`–`2024.Q3.13`\n    *   `2024.Q2.0`–`2024.Q2.13`\n    *   `2024.Q1.1`–`2024.Q1.12`\n\n### Remediation\n\nUpdate to the fixed builds and, for Maven consumers of the SAML module, upgrade `com.liferay:com.liferay.saml.impl` to **5.0.51** or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.","status":"published","published":"2025-09-24T03:30:26Z","modified":"2025-12-16T23:59:13Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2025-43819","description":"A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API","status":"published","published":"2025-09-24T02:15:31.107Z","modified":"2026-06-17T09:24:35.247Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:11:32.559087Z"}],"osv":[{"id":"CVE-2025-43819","description":"A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API","status":"published","published":"2025-09-24T02:15:31.107Z","modified":"2026-10-24T14:57:01.946660141Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-rpx3-f938-xj5q","title":"Liferay Portal and DXP does not properly expire sessions","description":"### Summary\n\nLiferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.\n\n### Affected Versions\n\nThe following platform versions are affected:\n\n*   **Liferay Portal:**  \n    *   `7.3.3.131` through `7.4.3.121`\n*   **Liferay DXP:**\n    *   `2024.Q4.0`–`2024.Q4.3`\n    *   `2024.Q3.1`–`2024.Q3.13`\n    *   `2024.Q2.0`–`2024.Q2.13`\n    *   `2024.Q1.1`–`2024.Q1.12`\n\n### Remediation\n\nUpdate to the fixed builds and, for Maven consumers of the SAML module, upgrade `com.liferay:com.liferay.saml.impl` to **5.0.51** or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.","status":"published","published":"2025-09-24T03:30:26Z","modified":"2025-12-17T00:09:20.555536Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}