CVE-2025-62248: XSS
A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the comliferaydynamicdatamappingwebportletDDMPortletdefinition parameter. The malicious payload is executed within the victim's browser when they access a URL that includes the crafted parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62248?
CVE-2025-62248 is classified as a medium severity reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2025-62248?
To fix CVE-2025-62248, upgrade Liferay Portal to version 7.4.3.133 or later and Liferay DXP to versions beyond the affected releases.
Which versions are affected by CVE-2025-62248?
CVE-2025-62248 affects Liferay Portal versions 7.4.0 to 7.4.3.132 and various Liferay DXP versions within specified ranges.
What can attackers do with CVE-2025-62248?
Attackers can exploit CVE-2025-62248 to execute arbitrary JavaScript code in the context of the user's browser, potentially compromising user data.
Is CVE-2025-62248 easy to exploit?
CVE-2025-62248 can be exploited through maliciously crafted links, making it relatively easy for attackers to target users.