GHSA-xcj6-xpjg-c4xr
NoneCVSS
—
EPSS
—
Published
Oct 28, 2025
CISA due date
—
The record
Liferay Portal Stores Password Reset Tokens in Plain Text
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:com.liferay.portal.impl | 0 | 92.0.2 |
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.100 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.100 |
Related vulnerabilities
- CVE-2025-62261 Liferay Portal Stores Password Reset Tokens in Plain Text Same vulnerability
- GHSA-6533-fhr2-f38h Liferay Portal and DXP use an incorrect cache-control header Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62276 Liferay Portal and DXP use an incorrect cache-control header Also affects com.liferay.portal:com.liferay.portal.impl
- GHSA-q95h-87j6-273x Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62254 Liferay Portal ComboServlet denial of service via large file combination Also affects com.liferay.portal:com.liferay.portal.impl
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom