Listen to this Post
The vulnerability CVE-2025-22087 exists within the audit event logging mechanism of Liferay Portal and DXP. When a user sets or uses the password reminder question feature, the system incorrectly includes the user’s submitted answer in the audit log entries. Normally, such sensitive information should be masked or excluded from logs. The flaw allows any authenticated user with permissions to access the audit event logs to view these answers. Since password reminder answers are often used for account recovery, their exposure significantly weakens account security. An attacker who obtains these answers could potentially use them to reset a user’s password and gain unauthorized access to the account. The issue affects specific versions of Liferay Portal 7.4.x and Liferay DXP 2023.Q3, 2023.Q4, and 7.4 GA.
Platform: Liferay Portal/DXP
Version: < 5.0.13, 7.4.0-7.4.3.112
Vulnerability: Information Disclosure
Severity: Moderate
date: 2025-09-23
Prediction: Patch available (5.0.13)
What Undercode Say:
`grep -r “passwordReminderAnswer” /opt/liferay/audit/`
`audit.event.user.update=User ${userId} updated profile, answer: ${answer}`
How Exploit:
Authenticated user accesses audit logs.
Filters events for user profile updates.
Extracts plaintext password reminder answers.
Protection from this CVE
Upgrade to patched version 5.0.13.
Review and sanitize existing audit logs.
Restrict access to audit event viewer.
Impact:
Exposure of secret question answers.
Potential for account takeover.
Compromise of account recovery security.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
