CVE-2025-62262: Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature

The vulnerability lies in the logging of sensitive user information (email addresses) during the LDAP import process. The analysis of the provided patch fc14297acd87703ba1027d691fa27a6b96bbb57c clearly shows that the log level for a message containing a user's email address was changed from INFO to DEBUG. This change was made in the _updateUser method of the com.liferay.portal.security.ldap.internal.exportimport.LDAPUserImporterImpl class. Logging at the INFO level is common in production environments, making the user's email address visible in the logs. By changing the log level to DEBUG, the information is less likely to be exposed in a production setting. Therefore, the _updateUser function is identified as the vulnerable function as it was responsible for logging the sensitive data.