CVE-2025-62239

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.6MEDIUM
EPSS
0.0%
top 92.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Liferay Digital Experience PlatformLiferay Liferay PortalLiferay DXP+1 more
Timeline
PublishedOct 10

Description

Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDliferay/liferay_portal7.4.3.21 — 7.4.3.112
▶CVEListV5liferay/portal7.4.3.21 — 7.4.3.111
▶NVDliferay/digital_experience_platform2023.q3.1 — 2023.q3.9+2
▶CVEListV5liferay/dxp7.4.13-u21 — 7.4.13-u92+2

🔴Vulnerability Details

3
GHSA
Liferay Portal is vulnerable to XSS through its workflow process builder↗2025-10-10
▶
OSV
Liferay Portal is vulnerable to XSS through its workflow process builder↗2025-10-10
▶
CVEList
CVE-2025-62239: Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7↗2025-10-10
▶
CVE-2025-62239 (MEDIUM CVSS 4.6) | Cross-site scripting (XSS) vulnerab | cvebase.io