VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 27, 2025· Updated Oct 28, 2025

CVE-2025-62261

CVE-2025-62261

Description

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:release.portal.bomMaven
>= 7.4.0-ga1, < 7.4.3.1007.4.3.100
com.liferay.portal:com.liferay.portal.implMaven
< 92.0.292.0.2

Affected products

2

Patches

1
b228c7878f2e

LPS-193886 Apply same logic as added in LPS-189689 so new user setup urls can be used properly

https://github.com/liferay/liferay-portalChrisKianOct 26, 2023via ghsa
commit
1 file changed · +13 −6
  • portal-impl/src/com/liferay/portal/service/impl/UserLocalServiceImpl.java+13 −6 modified
    @@ -6231,7 +6231,9 @@ else if (!user.isActive()) {
 		return true;
 	}
 
-	protected void notifyUser(User user, ServiceContext serviceContext) {
+	protected void notifyUser(User user, ServiceContext serviceContext)
+		throws PortalException {
+
 		if (!PrefsPropsUtil.getBoolean(
 				user.getCompanyId(),
 				PropsKeys.ADMIN_EMAIL_USER_ADDED_ENABLED)) {
@@ -6264,10 +6266,6 @@ protected void notifyUser(User user, ServiceContext serviceContext) {
 				PropsKeys.ADMIN_EMAIL_USER_ADDED_NO_PASSWORD_BODY);
 		}
 		else {
-			Ticket ticket = _ticketLocalService.addDistinctTicket(
-				user.getCompanyId(), User.class.getName(), user.getUserId(),
-				TicketConstants.TYPE_PASSWORD, null, null, serviceContext);
-
 			String updatePasswordURL = "/portal/update_password?";
 
 			long plid = serviceContext.getPlid();
@@ -6285,9 +6283,18 @@ protected void notifyUser(User user, ServiceContext serviceContext) {
 				}
 			}
 
+			Ticket ticket = _ticketLocalService.addDistinctTicket(
+				user.getCompanyId(), User.class.getName(), user.getUserId(),
+				TicketConstants.TYPE_PASSWORD, null, null, serviceContext);
+
 			passwordResetURL = StringBundler.concat(
 				serviceContext.getPortalURL(), serviceContext.getPathMain(),
-				updatePasswordURL, "ticketKey=", ticket.getKey());
+				updatePasswordURL, "ticketId=", ticket.getTicketId(),
+				"&ticketKey=", ticket.getKey());
+
+			ticket.setKey(PasswordEncryptorUtil.encrypt(ticket.getKey()));
+
+			_ticketLocalService.updateTicket(ticket);
 
 			localizedBodyMap = LocalizationUtil.getLocalizationMap(
 				companyPortletPreferences,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.