GitHub Advisoryadvisory · Maven

GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text

MEDIUM Published 2025-10-28 Modified 2025-11-15 Official page ↗
Aliases
CVE-2025-62261
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-312
Reviewed
2025-10-29

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0-ga1, < 7.4.3.100 → fixed in 7.4.3.100 • Maven com.liferay.portal:com.liferay.portal.impl: < 92.0.2 → fixed in 92.0.2

Description

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

Related

Alias · CVE (1)

  • CVE-2025-62261 Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References