CVE-2025-43814 Overview
CVE-2025-43814 is an information disclosure vulnerability in Liferay Portal and Liferay Digital Experience Platform (DXP). The audit events subsystem records a user's password reminder answer in plaintext within its logs. Any remote authenticated user with access to audit events can retrieve another user's password reminder answer, undermining an account recovery security control. The flaw is classified as [CWE-201: Insertion of Sensitive Information Into Sent Data].
Critical Impact
Authenticated attackers with audit event access can harvest password reminder answers, enabling account takeover through the password recovery workflow.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.112 (and older unsupported versions)
- Liferay DXP 2023.Q4.0 through 2023.Q4.8, and 2023.Q3.1 through 2023.Q3.10
- Liferay DXP 7.4 GA through update 92 (and older unsupported versions)
Discovery Timeline
- 2025-09-22 - CVE-2025-43814 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43814
Vulnerability Analysis
Liferay Portal and DXP provide an audit events framework that records user actions and administrative changes for compliance and forensic review. When users create or update their password reminder question and answer, the audit subsystem serializes the change payload into an audit record. That payload retains the answer value in cleartext instead of masking or omitting it.
Any authenticated user granted the ability to read audit events, typically administrators, auditors, or holders of custom roles with audit view permissions, can query these records. The reminder answer becomes a credential-equivalent secret that can be reused to complete the forgot-password workflow, reset the target account, and hijack the session.
Root Cause
The root cause is missing sensitive-data filtering in the audit event serializer. The portal treats the reminder answer as a regular user attribute during change tracking, so old and new values are written to the audit store without redaction. This violates the principle that authentication-related secrets should never persist in logs.
Attack Vector
Exploitation requires network access to a Liferay instance and an authenticated session with high privileges, since audit events are a restricted resource. An attacker with those privileges browses or exports audit events, filters on the reminder-answer field name, and extracts values for other users. The attacker then invokes the standard password recovery flow, supplies the recovered answer, and takes control of the target account. No user interaction is required from the victim.
The vulnerability results in confidentiality impact only. Integrity and availability are not directly affected by the disclosure itself, though follow-on account takeover can escalate impact.
Detection Methods for CVE-2025-43814
Indicators of Compromise
- Audit event exports or database queries targeting reminderQueryAnswer, reminder_query_answer, or equivalent Liferay user attribute fields.
- Repeated read access to the AuditEvent table or /api/jsonws/auditevent endpoints by non-security accounts.
- Password reset completions immediately followed by administrative actions from newly reset accounts.
Detection Strategies
- Review audit event content for the presence of reminder answer fields in additionalInfo or serialized change payloads.
- Correlate audit event reads with subsequent password-reset requests for the same user identifiers within short time windows.
- Baseline which roles legitimately need audit event access and alert on additions or privilege escalations that grant it.
Monitoring Recommendations
- Forward Liferay application and audit logs to a centralized analytics platform for anomaly detection on audit-event access patterns.
- Alert on bulk audit event exports, especially those filtered on user profile modification event types.
- Monitor User_ table changes to reminderQueryQuestion and reminderQueryAnswer columns and correlate with subsequent authentication events.
How to Mitigate CVE-2025-43814
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release beyond 7.4.3.112 and apply the corresponding DXP update above 7.4 update 92 or the latest 2023.Q4 quarterly release.
- Purge historical audit event records that contain reminder answer values, or restrict access to the audit event store until purged.
- Reset password reminder questions and answers for all users whose values may have been logged, or disable the reminder feature entirely if not required.
Patch Information
Liferay has published fix details in the Liferay CVE-2025-43814 Advisory. Apply the vendor-provided service pack, fix pack, or quarterly release that addresses the audit event redaction issue for your specific branch. Older unsupported versions do not receive fixes and should be upgraded to a supported release.
Workarounds
- Revoke audit event read permissions from all roles that do not strictly require them, limiting exposure to a minimal set of trusted administrators.
- Disable password reminder questions in the portal configuration (users.reminder.queries.enabled=false) so that no new answers are recorded and the recovery vector is removed.
- Implement database-level access controls on the AuditEvent table to restrict direct query access outside the application.
# Configuration example: disable password reminder queries in portal-ext.properties
users.reminder.queries.enabled=false
users.reminder.queries.custom.question.enabled=false
# Optional: restrict audit event access to a single dedicated role
# via Control Panel > Roles > [Audit Role] > Define Permissions > Audit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
