CVE-2025-62261: 
Liferay Portal Analisi e mitigazione delle vulnerabilità

CVE-2025-62261 affects Liferay Portal and DXP systems, discovered and disclosed on October 27, 2025. The vulnerability involves the storage of password reset tokens in plain text, affecting Liferay Portal versions 7.4.0 through 7.4.3.99 and older unsupported versions, as well as Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions (Liferay Security, NVD).

The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) with a CVSS v4.0 score of 6.9 MEDIUM (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N). The technical issue stems from the application storing password reset tokens in plain text format in the database, without proper encryption or protection mechanisms (NVD).

The vulnerability allows attackers with database access to obtain password reset tokens, which can be used to reset user passwords and subsequently take over user accounts. This poses a significant risk to account security and data confidentiality (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.100, Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, and Liferay DXP 7.3 U35. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).