CVE-2025-62237: XSS
Published Oct 10, 2025
·Updated
Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.
Affected Software
93 affected componentsFixes available
Liferay portal>=7.4.3.8<=7.4.3.111
Liferay DXP>=2023.Q4.0<2023.Q4.5, >=2023.Q3.1<2023.Q3.8
Liferay portal>=7.4 update 8<7.4 update 92
maven/com.liferay.commerce:com.liferay.commerce.order.web>=5.0.29<5.0.101
5.0.101
Liferay Digital Experience Platform>=2023.q3.1<2023.q3.9
Liferay Digital Experience Platform>=2023.q4.0<2023.q4.6
Liferay Digital Experience Platform=7.4
Liferay Digital Experience Platform=7.4-update10
Liferay Digital Experience Platform=7.4-update11
Liferay Digital Experience Platform=7.4-update12
Liferay Digital Experience Platform=7.4-update13
Liferay Digital Experience Platform=7.4-update14
Liferay Digital Experience Platform=7.4-update15
Liferay Digital Experience Platform=7.4-update16
Liferay Digital Experience Platform=7.4-update17
Liferay Digital Experience Platform=7.4-update18
Liferay Digital Experience Platform=7.4-update19
Liferay Digital Experience Platform=7.4-update20
Liferay Digital Experience Platform=7.4-update21
Liferay Digital Experience Platform=7.4-update22
Liferay Digital Experience Platform=7.4-update23
Liferay Digital Experience Platform=7.4-update24
Liferay Digital Experience Platform=7.4-update25
Liferay Digital Experience Platform=7.4-update26
Liferay Digital Experience Platform=7.4-update27
Liferay Digital Experience Platform=7.4-update28
Liferay Digital Experience Platform=7.4-update29
Liferay Digital Experience Platform=7.4-update30
Liferay Digital Experience Platform=7.4-update31
Liferay Digital Experience Platform=7.4-update32
Liferay Digital Experience Platform=7.4-update33
Liferay Digital Experience Platform=7.4-update34
Liferay Digital Experience Platform=7.4-update35
Liferay Digital Experience Platform=7.4-update36
Liferay Digital Experience Platform=7.4-update37
Liferay Digital Experience Platform=7.4-update38
Liferay Digital Experience Platform=7.4-update39
Liferay Digital Experience Platform=7.4-update40
Liferay Digital Experience Platform=7.4-update41
Liferay Digital Experience Platform=7.4-update42
Liferay Digital Experience Platform=7.4-update43
Liferay Digital Experience Platform=7.4-update44
Liferay Digital Experience Platform=7.4-update45
Liferay Digital Experience Platform=7.4-update46
Liferay Digital Experience Platform=7.4-update47
Liferay Digital Experience Platform=7.4-update48
Liferay Digital Experience Platform=7.4-update49
Liferay Digital Experience Platform=7.4-update50
Liferay Digital Experience Platform=7.4-update51
Liferay Digital Experience Platform=7.4-update52
Liferay Digital Experience Platform=7.4-update53
Liferay Digital Experience Platform=7.4-update54
Liferay Digital Experience Platform=7.4-update55
Liferay Digital Experience Platform=7.4-update56
Liferay Digital Experience Platform=7.4-update57
Liferay Digital Experience Platform=7.4-update58
Liferay Digital Experience Platform=7.4-update59
Liferay Digital Experience Platform=7.4-update60
Liferay Digital Experience Platform=7.4-update61
Liferay Digital Experience Platform=7.4-update62
Liferay Digital Experience Platform=7.4-update63
Liferay Digital Experience Platform=7.4-update64
Liferay Digital Experience Platform=7.4-update65
Liferay Digital Experience Platform=7.4-update66
Liferay Digital Experience Platform=7.4-update67
Liferay Digital Experience Platform=7.4-update68
Liferay Digital Experience Platform=7.4-update69
Liferay Digital Experience Platform=7.4-update70
Liferay Digital Experience Platform=7.4-update71
Liferay Digital Experience Platform=7.4-update72
Liferay Digital Experience Platform=7.4-update73
Liferay Digital Experience Platform=7.4-update74
Liferay Digital Experience Platform=7.4-update75
Liferay Digital Experience Platform=7.4-update76
Liferay Digital Experience Platform=7.4-update77
Liferay Digital Experience Platform=7.4-update78
Liferay Digital Experience Platform=7.4-update79
Liferay Digital Experience Platform=7.4-update8
Liferay Digital Experience Platform=7.4-update80
Liferay Digital Experience Platform=7.4-update81
Liferay Digital Experience Platform=7.4-update82
Liferay Digital Experience Platform=7.4-update83
Liferay Digital Experience Platform=7.4-update84
Liferay Digital Experience Platform=7.4-update85
Liferay Digital Experience Platform=7.4-update86
Liferay Digital Experience Platform=7.4-update87
Liferay Digital Experience Platform=7.4-update88
Liferay Digital Experience Platform=7.4-update89
Liferay Digital Experience Platform=7.4-update9
Liferay Digital Experience Platform=7.4-update90
Liferay Digital Experience Platform=7.4-update91
Liferay Digital Experience Platform=7.4-update92
Liferay Liferay Portal>=7.4.3.8<7.4.3.112
Event History
Oct 10, 2025
CVE Published
via MITRE·12:51 PM
Data Sourced
via MITRE·12:51 PM
DescriptionWeakness
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 PM
Affected Software
Advisory Published
via GitHub·03:31 PM
Data Sourced
via GitHub·03:31 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-62237?
CVE-2025-62237 is classified as a medium severity vulnerability due to its potential for exploitation via stored cross-site scripting.
2
How do I fix CVE-2025-62237?
To fix CVE-2025-62237, upgrade your Liferay Portal to version 7.4.3.112 or later, or update Liferay DXP to the latest patched version.
3
What versions are affected by CVE-2025-62237?
CVE-2025-62237 affects Liferay Portal versions from 7.4.3.8 to 7.4.3.111 and Liferay DXP versions 2023.Q4.0 to 2023.Q4.5 and 2023.Q3.1 to 2023.Q3.8.
4
Who can exploit CVE-2025-62237?
Remote attackers can exploit CVE-2025-62237 to inject arbitrary web script or HTML into the Commerce view order page.
5
What is the nature of the attack for CVE-2025-62237?
The attack vector for CVE-2025-62237 involves stored cross-site scripting, allowing the attacker to execute scripts in the context of the user's browser.