Home

Description

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

PUBLISHED Reserved 2025-10-09 | Published 2025-10-27 | Updated 2025-10-28 | Assigner Liferay




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-312 Cleartext Storage of Sensitive Information

Product status

Default status
unaffected

7.4.0 (maven)
affected

Default status
unaffected

7.3.10 (maven)
affected

7.4.13 (maven)
affected

2023.Q3.1 (maven)
affected

References

liferay.dev/...-/asset_publisher/jekt/content/CVE-2025-62261

cve.org (CVE-2025-62261)

nvd.nist.gov (CVE-2025-62261)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.