CVE-2025-43819: Liferay DXP Session Expiration Vulnerability

CVE-2025-43819 Overview

CVE-2025-43819 is an Insufficient Session Expiration vulnerability [CWE-613] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the Single Log-Out (SLO) API, which fails to fully invalidate user sessions after logout. A remote attacker can reuse an old session identifier through the SLO API to regain access to a previously authenticated context. The issue impacts multiple maintenance branches of Liferay Portal 7.3 and 7.4, as well as DXP 2024.Q1 through 2024.Q4 releases. Liferay published guidance in its security advisory portal identifying the affected versions and remediation paths.

Critical Impact
An attacker who obtains a stale session token can reuse it via the SLO API to access user data and functions bound to that session.

Affected Products

Liferay Portal 7.4.3.121 through 7.3.3.131
Liferay DXP 2024.Q4.0 through 2024.Q4.3 and 2024.Q3.1 through 2024.Q3.13
Liferay DXP 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12

Discovery Timeline

2025-09-24 - CVE-2025-43819 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43819

Vulnerability Analysis

The vulnerability stems from improper session lifecycle handling within Liferay's Single Log-Out (SLO) API. When a user logs out, the affected releases do not fully invalidate the associated server-side session state. An attacker who has captured or otherwise obtained a prior session token can replay it against the SLO API endpoint to reuse the old session. Because the flaw is exposed over the network and requires no user interaction, exploitation only depends on the attacker possessing or replaying a valid stale session artifact. Impact is limited to the confidentiality and integrity scope tied to the reused session, rather than direct code execution on the underlying host.

Root Cause

The root cause is classified as [CWE-613] Insufficient Session Expiration. The SLO endpoint treats terminated sessions as still valid under certain replay conditions, keeping the session identifier usable beyond its intended lifetime. Session invalidation logic does not enforce the state transition expected after logout.

Attack Vector

Exploitation occurs over the network against the SLO API endpoint. The attacker replays a previously issued session token, bypassing the expected logout invalidation and obtaining access to the associated authenticated context. No specialized tooling or privileged local access is required. Refer to the Liferay Security Advisory for CVE-2025-43819 for vendor-published technical details.

Detection Methods for CVE-2025-43819

Indicators of Compromise

Repeated requests to the Liferay SLO API endpoint using session identifiers that were previously issued to logged-out users.
Session identifiers appearing in access logs from multiple source IP addresses within a short interval.
Authenticated activity following a confirmed logout event for the same user account.

Detection Strategies

Correlate logout events with subsequent authenticated requests bearing the same JSESSIONID or session cookie to identify replay attempts.
Alert on SLO API calls originating from IP addresses or user agents that differ from the session's original authentication context.
Baseline expected session lifetimes and flag sessions that remain active beyond configured expiration windows.

Monitoring Recommendations

Enable verbose access logging on Liferay Portal front-end reverse proxies and archive logs in a centralized data lake for retrospective search.
Monitor authentication and session-management audit events for anomalies indicating session reuse after logout.
Track error and success rates on the SLO API endpoint to detect volumetric enumeration or replay behavior.

How to Mitigate CVE-2025-43819

Immediate Actions Required

Inventory all Liferay Portal 7.3, 7.4, and DXP 2024.Q1–Q4 deployments and identify build versions that fall within the affected ranges.
Apply the fixed release or hotfix published by Liferay in the vendor advisory as soon as maintenance windows allow.
Force global session invalidation for existing user sessions after patching to eliminate any stale tokens already in circulation.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory for CVE-2025-43819. Administrators should upgrade affected Liferay Portal and DXP deployments to the fixed versions listed by the vendor. Customers on Liferay DXP subscription channels should follow the Q-release upgrade guidance for 2024.Q1 through 2024.Q4.

Workarounds

Restrict network access to the SLO API endpoint using a reverse proxy or web application firewall while patches are staged.
Shorten server-side session timeouts to reduce the window in which a captured token remains usable.
Enforce transport-layer protections and secure cookie attributes (HttpOnly, Secure, SameSite) to reduce session token exposure.

bash

# Example: shorten Liferay session timeout in portal-ext.properties
session.timeout=15
session.timeout.auto.extend=false
session.enable.phishing.protection=true