CVE-2025-62261: Liferay DXP Information Disclosure Flaw

CVE-2025-62261 Overview

CVE-2025-62261 affects Liferay Portal and Liferay Digital Experience Platform (DXP). The application stores password reset tokens in plain text within the database. An attacker with database access can retrieve these tokens, reset any user's password, and take over the associated account. The flaw is classified as Cleartext Storage of Sensitive Information [CWE-312].

Affected releases include Liferay Portal 7.4.0 through 7.4.3.99, older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 34.

Critical Impact
Any actor with read access to the Liferay database can hijack accounts, including administrative accounts, by replaying stored password reset tokens.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.99 and older unsupported versions
Liferay DXP 2023.Q3.1 through 2023.Q3.4
Liferay DXP 7.4 GA through update 92 and 7.3 GA through update 34

Discovery Timeline

2025-10-27 - CVE-2025-62261 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62261

Vulnerability Analysis

Liferay Portal and DXP implement a self-service password reset workflow. When a user requests a reset, the application generates a token, emails a link containing the token to the user, and stores a copy of the token in the underlying database for later validation. In the affected versions, the stored copy is written in cleartext rather than as a cryptographic hash.

Any principal that can read the reset token column, including database administrators, backup operators, secondary replica readers, or an attacker who has obtained credentials to the datastore, can select an active token and complete the reset flow against the web application. The reset flow accepts the token over the network without additional authentication of the requester.

Because the flaw sits in the storage layer, application-tier protections such as rate limiting, CAPTCHA, or email verification do not prevent exploitation once the token has been retrieved from the database.

Root Cause

The root cause is a design defect in secret handling. Password reset tokens function as short-lived bearer credentials and must be stored using a one-way function so that only the value transmitted to the legitimate user can satisfy verification. Liferay stored the raw token, converting the reset table into a repository of valid authentication material.

Attack Vector

Exploitation requires prior access to the Liferay database. Typical paths include compromised database credentials, exposure of a backup, an SQL injection defect elsewhere in the environment, or misuse by an insider with legitimate query privileges. The attacker selects an unexpired token from the reset table, submits it to the public reset endpoint, sets a new password, and authenticates as the target user.

See the Liferay Security Advisory CVE-2025-62261 for vendor technical details.

Detection Methods for CVE-2025-62261

Indicators of Compromise

Password reset completions for accounts that did not initiate a reset request, particularly for privileged users.
Successful logins from new IP addresses or user agents immediately following a password change event.
Direct SELECT queries against Liferay password reset or ticket tables from application accounts that do not normally issue such queries.
Reset link submissions where the source IP differs from the IP that received the original reset email.

Detection Strategies

Correlate Liferay application logs for password_reset events with the originating request that generated the reset token. A mismatch between requester and completer indicates token replay.
Alert on database query patterns that read the reset-token column outside of the Liferay application service account.
Monitor for administrator account password changes that are not preceded by a helpdesk ticket or self-service request.

Monitoring Recommendations

Forward Liferay authentication and audit logs, plus database audit logs, to a centralized SIEM for correlation across the application and data tiers.
Track access to the Liferay database schema and generate alerts on ad-hoc reads of authentication-related tables.
Baseline normal password reset volume per hour and alert on statistical deviations that may indicate bulk token abuse.

How to Mitigate CVE-2025-62261

Immediate Actions Required

Apply the fixed Liferay Portal and DXP releases published in the vendor advisory as soon as testing permits.
Invalidate all outstanding password reset tokens in the database after patching to remove any cleartext values an attacker may already have captured.
Rotate database credentials, backup encryption keys, and any accounts that could have accessed the reset token table.
Review recent password reset and authentication logs for signs of token replay against privileged accounts.

Patch Information

Liferay has published fixed builds and mitigation guidance in the Liferay Security Advisory CVE-2025-62261. Administrators running Liferay Portal 7.4.x and DXP 7.3, 7.4, or 2023.Q3 should upgrade to the vendor-designated fixed update level. Older unsupported branches require migration to a supported release.

Workarounds

Restrict database access to the Liferay application service account only, and remove standing read access from human operators.
Encrypt database backups and enforce strict access controls on backup storage until patching is complete.
Shorten the password reset token lifetime in Liferay configuration to reduce the window in which a stolen token remains valid.
Require administrators to use multi-factor authentication so that a hijacked password alone is insufficient to log in.

bash

# Example: invalidate outstanding reset tickets after patching
# Review the vendor advisory before running in production
UPDATE Ticket SET expirationDate = CURRENT_TIMESTAMP
 WHERE type = 2 AND expirationDate > CURRENT_TIMESTAMP;