CVE-2023-47798: 
Java vulnerability analysis and mitigation

CVE-2023-47798 is a security vulnerability affecting Liferay Portal versions 7.2.0 through 7.3.0 and Liferay DXP 7.2 before fix pack 5, as well as older unsupported versions. The vulnerability was discovered and disclosed in February 2024. The affected systems fail to invalidate existing user sessions during account lockout scenarios (Liferay Advisory).

The vulnerability is classified as CWE-384 (Session Fixation) with a CVSS v3.1 base score of 5.4 (Medium) severity. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD).

When exploited, this vulnerability allows remote authenticated users to maintain their authentication status even after their account has been locked. This behavior could potentially enable unauthorized access to system resources and compromise the security of the affected systems (Liferay Advisory).

The vulnerability has been addressed in Liferay Portal 7.3.1 and Liferay DXP 7.2 fix pack 5. Users of affected versions should upgrade to these patched versions to mitigate the security risk (Liferay Advisory).