PT-2025-45794 · Maven · Com.Liferay.Portal:Com.Liferay.Portal.Impl+1

Publicado 2025-10-28 · Atualizado 2025-10-28

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

GHSA-XCJ6-XPJG-C4XR

Produtos afetados

Com.Liferay.Portal:Com.Liferay.Portal.Impl

Com.Liferay.Portal:Release.Portal.Bom

Referências · 6

• https://github.com/liferay/liferay-portal · Nota
• https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c · Nota
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261 · Nota
• https://liferay.atlassian.net/browse/LPE-17785 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-62261 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xcj6-xpjg-c4xr · Aviso do Fabricante