Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.liferay:com.liferay.saml.impl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Liferay Portal and DXP does not properly expire sessions

    CVE-2025-43819 · GHSA-rpx3-f938-xj5q

    Affected
    • Maven com.liferay:com.liferay.saml.impl < 5.0.51
    Fixed in
    5.0.51· Vendor fix available
    Issue
    Liferay Portal/DXP contains an Insufficient Session Expiration issue where the Single Logout (SLO) API may fail to invalidate a user’s previous session. An attacker can reuse a stale session via the SLO endpoint to gain an authenticated context. Affected Versions The following platform versions are affected: Liferay Portal: 7.3.3.131 through 7.4.3.121 Liferay DXP: 2024.Q4.0–2024.Q4.3 2024.Q3.1–2024.Q3.13 2024.Q2.0–2024.Q2.13 2024.Q1.1–2024.Q1.12 Remediation Update to the fixed builds and, for Maven consumers of the SAML module, upgrade com.liferay:com.liferay.saml.impl to 5.0.51 or later. After upgrading, ensure session invalidation policies are enforced and verify SLO behavior end-to-end.

    Recommended action: Upgrade to 5.0.51 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →