PT-2025-44047 · Liferay · Liferay Portal+1

Published 2025-10-27 · Updated 2025-11-10 · CVE-2025-62261

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.99 Liferay Portal versions 7.4 GA through update 92 Liferay Portal versions 7.3 GA through update 34 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Older unsupported versions of Liferay Portal and Liferay DXP

Description The software stores password reset tokens in plain text. This allows attackers who gain access to the database to obtain the token, reset a user’s password, and take over the user’s account.

Recommendations Update Liferay Portal to a version after 7.4.3.99. Update Liferay Portal to a version after update 92. Update Liferay Portal to a version after update 34. Update Liferay DXP to a version after 2023.Q3.4.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-62261

GHSA-XCJ6-XPJG-C4XR

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-62261 · Security Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcj6-xpjg-c4xr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62261 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c · Note
• https://t.me/CVEtracker/35904 · Telegram Post
• https://liferay.atlassian.net/browse/LPE-17785 · Note
• https://t.me/cveNotify/142343 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983021045306040812 · Twitter Post
• https://t.me/cveNotify/140570 · Telegram Post