CVE-2025-62261
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34 and older unsupported versions, store password reset tokens in plain text. This allows attackers with database access to obtain the token, reset a user's password, and take over the account.
Risk Assessment
An attacker with database access can read plaintext password reset tokens and take over user accounts, including administrators.
Recommendation
Update Liferay Portal/DXP to a version containing the fix. Restrict database access and monitor for suspicious password reset operations.
Other vulnerabilities in Liferay Portal/DXP
See all- CVE-2025-43773Critical
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP in the listed versions has a security vulnerability allowing improper access through the expandoTableLocalService. This may allow unauthorized access to data or functions.
- CVE-2025-62275Medium
Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.
- CVE-2025-62256Medium
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.
- CVE-2025-43763Medium
A server-side request forgery (SSRF) vulnerability exists in Liferay Portal 7.4.0 through 7.4.3.131 and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.20 affecting custom object attachment fields. This flaw allows an attacker to manipulate the application into making unauthorized requests to other instances, creating new object entries that link to external resources.
Original NVD description (English source)
Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS