| Package | Affected versions | Patched versions |
|---|---|---|
| com.liferay:com.liferay.saml.impl | < 5.0.51 | 5.0.51 |
| digital experience platform | = 7.4≥ 2024.Q1.1, < 2024.Q1.13≥ 2024.Q4.0, < 2024.Q4.4≥ 2024.q2.0, ≤ 2024.q2.13≥ 2024.q3.1, ≤ 2024.q3.13 | 2024.Q1.132024.Q4.4 |
| liferay portal | ≥ 7.4.3.121, < 7.4.3.132 | 7.4.3.132 |
Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context.
The following platform versions are affected:
7.3.3.131 through 7.4.3.1212024.Q4.0–2024.Q4.32024.Q3.1–2024.Q3.132024.Q2.0–2024.Q2.132024.Q1.1–2024.Q1.12Update to the fixed builds and, for Maven consumers of the SAML module, upgrade com.liferay:com.liferay.saml.impl to 5.0.51 or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free