CVE-2025-62248
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability, caused by a regression, was identified in Liferay Portal and Liferay DXP. A remote authenticated attacker can inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter, and the malicious payload executes in the victim's browser when they access a crafted URL.
Risk Assessment
This may lead to session or credential theft of portal users and to unauthorized actions performed in their context. The risk affects organizations exposing the portal to external users.
Recommendation
Update Liferay Portal and Liferay DXP to a version containing the fix. Additionally, implement input validation and encoding as well as a Content Security Policy.
Other vulnerabilities in Liferay Portal / Liferay DXP
See all- CVE-2025-62254High
The ComboServlet in Liferay Portal and Liferay DXP does not limit the number or size of files it combines. A remote attacker can craft URL query strings to generate very large responses, leading to a denial of service attack.
- CVE-2025-62255Medium
Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions, are vulnerable to self-XSS on the edit Knowledge Base article page. A remote attacker can inject arbitrary script or HTML via a crafted payload in an attachment's filename.
- CVE-2025-62247Medium
Missing authorization in the Collection Provider component of Liferay Portal and Liferay DXP. Instance users can read and select unauthorized Blueprints across instances.
- CVE-2025-62251Medium
The Menu Display Widget in Liferay Portal and Liferay DXP shows content to users who lack permission to view it. This could expose sensitive information to unauthorized users.
- CVE-2025-62252Medium
An IDOR vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.
- CVE-2025-62243Medium
An insecure direct object reference (IDOR) and improper permission check vulnerability exists in Publications in Liferay Portal and Liferay DXP. A remote authenticated attacker can view publication comments via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter and edit comments via crafted URLs.
- CVE-2025-62244Medium
An insecure direct object reference (IDOR) vulnerability exists in the Publications module of Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 36. A remote authenticated attacker can view the edit page of a publication via the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter.
- CVE-2025-62245Medium
Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote attackers to add and edit publication comments.
- CVE-2025-62239Medium
A cross-site scripting (XSS) vulnerability in the workflow process builder in Liferay Portal and Liferay DXP allows remote authenticated attackers to inject arbitrary web script or HTML via crafted input in a workflow definition.
- CVE-2025-43771Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via crafted payloads in user's First Name, Middle Name, Last Name, 'Other Reason' text field, or the name of flagged content.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. The malicious payload is executed within the victim's browser when they access a URL that includes the crafted parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS