CVE-2025-62249
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-12-12

Assigner: Liferay Inc.

Description
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-21
Last Modified
2025-12-12
Generated
2026-06-16
AI Q&A
2025-10-21
EPSS Evaluated
2026-06-14
NVD
CVE-2025-62249
EUVD
EUVD-2025-35212
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
liferay digital_experience_platform From 2023.q4.0 (inc) to 2023.q4.10 (inc)
liferay digital_experience_platform From 2024.q1.1 (inc) to 2024.q1.21 (exc)
liferay digital_experience_platform From 2024.q2.0 (inc) to 2024.q2.13 (inc)
liferay digital_experience_platform From 2024.q3.1 (inc) to 2024.q3.13 (inc)
liferay digital_experience_platform From 2025.q1.0 (inc) to 2025.q1.18 (exc)
liferay digital_experience_platform From 2025.q2.0 (inc) to 2025.q2.12 (inc)
liferay digital_experience_platform From 2025.q3.0 (inc) to 2025.q3.3 (exc)
liferay liferay_portal From 7.4.0 (inc) to 7.4.3.132 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in certain versions of Liferay Portal and Liferay DXP. It allows a remote attacker who does not need to be authenticated to inject malicious JavaScript code into the google_gadget component, which can then be executed in the context of a victim's browser.

Impact Analysis

The vulnerability can allow attackers to execute arbitrary JavaScript in users' browsers, potentially leading to theft of sensitive information, session hijacking, or performing actions on behalf of the user without their consent. This can compromise user data and the security of the affected system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart