Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-62261

CVE-2025-62261: Liferay Portal Stores Password Reset Tokens in Plain Text

N/A

CVSS Score

Basic Information

CVE ID
CVE-2025-62261
GHSA ID
GHSA-xcj6-xpjg-c4xr
EPSS Score
0.0608%
CWE
CWE-312
Published
10/28/2025
Updated
10/29/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.liferay.portal:release.portal.bommaven>= 7.4.0-ga1, < 7.4.3.1007.4.3.100
com.liferay.portal:com.liferay.portal.implmaven< 92.0.292.0.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis of the provided patch b228c7878f2ed5ad8dbc1ff7ec9b5e6d53bb4b5c clearly indicates a security vulnerability within the notifyUser method of the com.liferay.portal.service.impl.UserLocalServiceImpl class. The vulnerability lies in the handling of password reset tokens. The patch introduces encryption for the password reset token (ticket.getKey()) before it is persisted. The lines ticket.setKey(PasswordEncryptorUtil.encrypt(ticket.getKey())); and _ticketLocalService.updateTicket(ticket); are the explicit fix. This confirms that prior to this change, the token was stored in cleartext, which is the core of the described vulnerability (CVE-2025-62261). Therefore, the notifyUser function is the vulnerable function, as it is responsible for generating and storing the unencrypted token.

Vulnerable functions

com.liferay.portal.service.impl.UserLocalServiceImpl.notifyUser
portal-impl/src/com/liferay/portal/service/impl/UserLocalServiceImpl.java
The `notifyUser` function generates a password reset token (ticket) for new users. Before the patch, the token's key (`ticket.getKey()`) was stored in the database in plaintext. An attacker with database access could retrieve this token and use it to reset the user's password and take over the account. The patch fixes this by encrypting the ticket key before it's stored.

WAF Protection Rules

WAF Rule

Li**r*y Port*l *.*.* t*rou** *.*.*.**, *n* ol**r unsupport** v*rsions, *n* Li**r*y *XP ****.Q*.* t*rou** ****.Q*.*, *.* ** t*rou** up**t* **, *.* ** t*rou** up**t* **, *n* ol**r unsupport** v*rsions stor*s p*sswor* r*s*t tok*ns in pl*in t*xt, w*i** *

Reasoning

T** *n*lysis o* t** provi*** p*t** `****************************************` *l**rly in*i**t*s * s**urity vuln*r**ility wit*in t** `noti*yUs*r` m*t*o* o* t** `*om.li**r*y.port*l.s*rvi**.impl.Us*rLo**lS*rvi**Impl` *l*ss. T** vuln*r**ility li*s in t**