CVE-2025-62246: XSS
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or last name text field to (1) page comments widget, (2) blog entry comments, (3) document and media document comments, (4) message board messages, (5) wiki page comments or (6) other widgets/apps that supports mentions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62246?
CVE-2025-62246 is considered a high severity vulnerability due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2025-62246?
To fix CVE-2025-62246, upgrade to the latest version of Liferay Portal or Liferay DXP where the vulnerabilities have been addressed.
What software versions are affected by CVE-2025-62246?
CVE-2025-62246 affects Liferay Portal versions 7.4.0 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, along with other unsupported versions.
Can remote users exploit CVE-2025-62246?
Yes, remote authenticated users can exploit CVE-2025-62246 to execute malicious scripts, affecting other users of the application.
What types of attacks can CVE-2025-62246 lead to?
CVE-2025-62246 can lead to various attacks such as session hijacking, data theft, and unauthorized actions performed on behalf of users.