PT-2025-44661 · Liferay · Liferay Portal+1
Published
2025-10-31
·
Updated
2025-11-10
·
CVE-2025-62267
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Liferay Portal versions 7.4.3.35 through 7.4.3.111
Liferay DXP versions 2023.Q3.1 through 2023.Q3.10
Liferay DXP versions 2023.Q4.0 through 2023.Q4.10
Liferay Portal versions 7.4 update 35 through update 92
Description
The software contains multiple cross-site scripting (XSS) issues within the web content template’s select structure page. These issues allow remote attackers to inject arbitrary web script or HTML. The injection occurs through crafted payloads inserted into the
First Name, Middle Name, or Last Name text fields of a user’s profile.Recommendations
Update Liferay Portal to a version later than 7.4.3.111.
Update Liferay DXP to a version later than 2023.Q4.10.
Update Liferay DXP to a version later than 2023.Q3.10.
Update Liferay Portal to a version later than update 92.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liferay Dxp
Liferay Portal