Liferay Portal and Liferay DXP Password Reset Token Storage Vulnerability

A vulnerability exists in Liferay Portal versions 7.4.0 through 7.4.3.99, older unsupported versions, and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions. These versions store password reset tokens in plain text, allowing attackers with database access to retrieve the tokens, reset user passwords, and take over user accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password resets and account takeovers.

Remediation

Users can upgrade to Liferay Portal 7.4.3.100 or Liferay DXP versions 2024.Q1.1, 2023.Q4.0, 2023.Q3.5, or 7.3 U35 to address this vulnerability.