PT-2025-44448 · Liferay · Liferay Portal+1

Foobar7

·

Published

2025-10-30

·

Updated

2025-11-03

·

CVE-2025-62265

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q4.10 Liferay Portal versions 7.3 GA through update 36 Liferay DXP versions 7.4 GA through update 92
Description A cross-site scripting (XSS) issue exists in the Blogs widget. The widget does not include the sandbox attribute for <iframe> elements, potentially allowing attackers to access the parent page through scripts and links within the frame. This can be triggered by injecting a crafted <iframe> into the “Content” text field of a blog entry.
Recommendations Update Liferay Portal to a version later than 7.4.3.111. Update Liferay DXP to a version later than 2023.Q4.10. Update Liferay DXP to a version later than 2023.Q3.8. Update Liferay Portal to a version later than update 92. Update Liferay Portal to a version later than update 36.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62265
GHSA-56JV-4WW3-65MW

Affected Products

Liferay Dxp
Liferay Portal