Executive Summary

CVE-2025-62267 is a stored cross-site scripting (XSS) vulnerability in the web content template's select structure page of Liferay Portal and Liferay DXP. It allows remote attackers to inject arbitrary web scripts or HTML by submitting crafted payloads into the user's First Name, Middle Name, or Last Name text fields. This means malicious code can be stored and executed in the application when other users view the affected content. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the context of other users, potentially leading to theft of sensitive information, session hijacking, or performing actions on behalf of the user. However, the CVSS score indicates that the impact on confidentiality and integrity is low, and availability is not affected. Exploitation requires high privileges and user interaction. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if user input fields for First Name, Middle Name, or Last Name in the affected Liferay Portal or DXP versions are vulnerable to stored XSS by submitting crafted payloads and observing if the scripts are executed. There are no specific commands provided in the resources. A practical approach is to test these fields with typical XSS payloads (e.g., <script>alert(1)</script>) and monitor the web application behavior or use web vulnerability scanners that support stored XSS detection. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Liferay Portal to version 7.4.3.112 or later, or Liferay DXP to version 2024.Q1.1 or later, where the vulnerability has been fixed. Until the upgrade can be applied, restrict user input in the affected fields to disallow script tags or suspicious HTML, and apply web application firewall (WAF) rules to block malicious payloads targeting these fields. [1]

Useful 0 Not Useful 0