PT-2025-44029 · Liferay · Liferay Dxp+1

Published

2025-10-27

·

Updated

2025-11-10

·

CVE-2025-62263

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.7 through 7.4.3.103 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 GA through update 92 Liferay Portal 7.3 service pack 3 through update 36
Description The software contains multiple cross-site scripting (XSS) issues. Remote attackers can inject arbitrary web script or HTML code through crafted payloads. Specifically, the vulnerabilities exist when injecting payloads into the “Title” text field of an Account Role and the “Name” text field of an Organization. Exploitation via the Account Role “Title” field can allow attackers to view or select account role pages. Exploitation via the Organization “Name” field can allow attackers to view or select account pages and account organization pages.
Recommendations Liferay Portal versions 7.3.7 through 7.4.3.103 should be updated. Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 should be updated. Liferay DXP 7.4 GA through update 92 should be updated. Liferay Portal 7.3 service pack 3 through update 36 should be updated.

Fix

XSS

Insertion into Log File

Weakness Enumeration

CWE-79CWE-532

Related Identifiers

CVE-2025-62263
GHSA-8MGF-RGG5-W38Q
GHSA-CW79-FQ4F-9R96

Affected Products

Liferay Dxp
Liferay Portal