CVE-2025-62248

Description

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. The malicious payload is executed within the victims browser when they access a URL that includes the crafted parameter.

Risk Information

Base Score

4.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.028

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-62248 are affected in Liferay - com.liferay.dynamic.data.mapping.web 5.0.122	Windows
Vulnerabilities CVE-2025-62248 are affected in Liferay - com.liferay.dynamic.data.mapping.web for Linux 5.0.122	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234