PT-2025-41810 · Liferay · Liferay Portal+1

Foobar7

·

Published

2025-10-13

·

Updated

2025-10-15

·

CVE-2025-62246

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.8 Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 Liferay Portal 7.4 GA through update 92 Older unsupported versions of Liferay Portal and Liferay DXP
Description The software contains multiple stored cross-site scripting (XSS) flaws. These flaws allow a remote authenticated user to inject arbitrary web script or HTML through a crafted payload. The payload is injected into a user’s first, middle, or last name text field. This can affect several widgets and applications, including the page comments widget, blog entry comments, document and media document comments, message board messages, wiki page comments, and other widgets/apps that support mentions.
Recommendations Update Liferay Portal to a version later than 7.4.3.111. Update Liferay DXP to a version later than 2023.Q4.5. Update Liferay DXP to a version later than 2023.Q3.8. Update Liferay Portal 7.4 GA to a version later than update 92.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62246
GHSA-MJ68-2XR5-28XH

Affected Products

Liferay Dxp
Liferay Portal