CVE-2025-62261: Medium severity Liferay portal vulnerability

Published Oct 27, 2025
·
Updated

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

Affected Software

51 affected componentsFixes available
Liferay portal>=7.4.0<=7.4.3.99, <=7.4.3.99
Liferay DXP>=2023.Q3.1<=2023.Q3.4
Liferay portal>=7.4.0<=7.4.92, >=7.3.0<=7.3.34
maven/com.liferay.portal:com.liferay.portal.impl<92.0.2
92.0.2
maven/com.liferay.portal:release.portal.bom>=7.4.0-ga1<7.4.3.100
7.4.3.100
Liferay Digital Experience Platform=7.3
Liferay Digital Experience Platform=7.3-fix_pack_1
Liferay Digital Experience Platform=7.3-fix_pack_2
Liferay Digital Experience Platform=7.3-service_pack_1
Liferay Digital Experience Platform=7.3-service_pack_2
Liferay Digital Experience Platform=7.3-service_pack_3
Liferay Digital Experience Platform=7.3-update1
Liferay Digital Experience Platform=7.3-update10
Liferay Digital Experience Platform=7.3-update11
Liferay Digital Experience Platform=7.3-update12
Liferay Digital Experience Platform=7.3-update13
Liferay Digital Experience Platform=7.3-update14
Liferay Digital Experience Platform=7.3-update15
Liferay Digital Experience Platform=7.3-update16
Liferay Digital Experience Platform=7.3-update17
Liferay Digital Experience Platform=7.3-update18
Liferay Digital Experience Platform=7.3-update19
Liferay Digital Experience Platform=7.3-update2
Liferay Digital Experience Platform=7.3-update20
Liferay Digital Experience Platform=7.3-update21
Liferay Digital Experience Platform=7.3-update22
Liferay Digital Experience Platform=7.3-update23
Liferay Digital Experience Platform=7.3-update24
Liferay Digital Experience Platform=7.3-update25
Liferay Digital Experience Platform=7.3-update26
Liferay Digital Experience Platform=7.3-update27
Liferay Digital Experience Platform=7.3-update28
Liferay Digital Experience Platform=7.3-update29
Liferay Digital Experience Platform=7.3-update3
Liferay Digital Experience Platform=7.3-update30
Liferay Digital Experience Platform=7.3-update31
Liferay Digital Experience Platform=7.3-update32
Liferay Digital Experience Platform=7.3-update33
Liferay Digital Experience Platform=7.3-update34
Liferay Digital Experience Platform=7.3-update4
Liferay Digital Experience Platform=7.3-update5
Liferay Digital Experience Platform=7.3-update6
Liferay Digital Experience Platform=7.3-update7
Liferay Digital Experience Platform=7.3-update8
Liferay Digital Experience Platform=7.3-update9
Liferay Digital Experience Platform=7.4
Liferay Digital Experience Platform=2023.q3.1
Liferay Digital Experience Platform=2023.q3.2
Liferay Digital Experience Platform=2023.q3.3
Liferay Digital Experience Platform=2023.q3.4
Liferay Liferay Portal>=7.0.0<7.4.3.100

Event History

Oct 27, 2025
CVE Published
via MITRE·09:11 PM
Data Sourced
via MITRE·09:11 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
Affected Software
Oct 28, 2025
Advisory Published
via GitHub·12:31 AM
Data Sourced
via GitHub·12:31 AM
DescriptionWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-62261?

CVE-2025-62261 is classified with a high severity due to the exposure of sensitive password reset tokens in plain text.

2

How do I fix CVE-2025-62261?

To fix CVE-2025-62261, upgrade to the latest version of Liferay Portal or Liferay DXP that addresses this vulnerability.

3

What versions are affected by CVE-2025-62261?

CVE-2025-62261 affects Liferay Portal versions 7.4.0 to 7.4.3.99 and Liferay DXP versions 2023.Q3.1 to 2023.Q3.4.

4

What is the risk of not addressing CVE-2025-62261?

Not addressing CVE-2025-62261 may allow attackers to gain unauthorized access to user accounts through compromised password reset tokens.

5

Is there a workaround for CVE-2025-62261?

Currently, there is no official workaround for CVE-2025-62261; upgrading to a patched version is the recommended mitigation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203