Description Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.
A vulnerability in Liferay DXP in various versions allows a time-based one-time password (TOTP) to be reused multiple times within its validity period. This flaw enables attackers with access to a user's TOTP to authenticate as that user.
Users can upgrade to Liferay DXP 2024.Q1.1, 2023.Q4.1, 2023.Q3.5 or 7.3 U36 to address this vulnerability.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 16, 2025 Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions liferay digital experience platform >= 2023.q3.1, < 2023.q3.5
7.3 -
7.3 fix_pack_1
7.3 fix_pack_2
7.3 service_pack_1
7.3 service_pack_2
7.3 service_pack_3
7.3 update1
7.3 update10
7.3 update11
7.3 update12
7.3 update13
7.3 update14
7.3 update15
7.3 update16
7.3 update17
7.3 update18
7.3 update19
7.3 update2
7.3 update20
7.3 update21
7.3 update22
7.3 update23
7.3 update24
7.3 update25
7.3 update26
7.3 update27
7.3 update28
7.3 update29
7.3 update3
7.3 update30
7.3 update31
7.3 update32
7.3 update33
7.3 update34
7.3 update35
7.3 update4
7.3 update5
7.3 update6
7.3 update7
7.3 update8
7.3 update9
7.4
2023.q4.0
Viewing 5 of 44 versions. View all CPE cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:-:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:service_pack_3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update1:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update10:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update11:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update12:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update13:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update14:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update15:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update16:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update17:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update18:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update19:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update2:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update20:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update21:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update22:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update23:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update24:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update25:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update26:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update27:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update28:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update29:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update3:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update30:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update31:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update32:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update33:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update34:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update35:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update4:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update5:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update6:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update7:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update8:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.3:update9:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:7.4:*:*:*:*:*:*:* cpe:2.3:a:liferay:digital_experience_platform:2023.q4.0:*:*:*:*:*:*:* Remediation No remediation found in references.
Change History 4 change records found show changes