Read the docs
TI-2025-38546 Aliases CVE-2025-62237GHSA-m4g9-5mg6-gfr3

Cross-site scripting in Liferay Portal

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed com.liferay.commerce:com.liferay.commerce.order.web (Maven): 5.0.101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LiferayPortal7.4.3.8 – 7.4.3.111—No fix listedCNA
LiferayDXP7.4.13-u8 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.8; 2023.Q4.0 – 2023.Q4.5—No fix listedCNA
—com.liferay.commerce:com.liferay.commerce.order.web (Maven)5.0.29 to before 5.0.1015.0.101Patch availableGHSA-m4g9-5mg6-gfr3
  • Portal VendorLiferay Affected 7.4.3.8 – 7.4.3.111 Fixed in — No fix listed CNA
  • DXP VendorLiferay Affected 7.4.13-u8 – 7.4.13-u92; 2023.Q3.1 – 2023.Q3.8; 2023.Q4.0 – 2023.Q4.5 Fixed in — No fix listed CNA
  • com.liferay.commerce:com.liferay.commerce.order.web (Maven) Vendor— Affected 5.0.29 to before 5.0.101 Fixed in 5.0.101 Patch available GHSA-m4g9-5mg6-gfr3

CPE configurations NVD · 88

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:*2023.q3.1 to before 2023.q3.9; 2023.q4.0 to before 2023.q4.6VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:*7.4VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:*7.4 update10VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:*7.4 update11VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:*7.4 update12VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:*7.4 update13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:*7.4 update14VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:*7.4 update15VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:*7.4 update16VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:*7.4 update17VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* Versions 2023.q3.1 to before 2023.q3.9; 2023.q4.0 to before 2023.q4.6 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update10:*:*:*:*:*:* Versions 7.4 update10 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update11:*:*:*:*:*:* Versions 7.4 update11 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update12:*:*:*:*:*:* Versions 7.4 update12 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update13:*:*:*:*:*:* Versions 7.4 update13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update14:*:*:*:*:*:* Versions 7.4 update14 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update15:*:*:*:*:*:* Versions 7.4 update15 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update16:*:*:*:*:*:* Versions 7.4 update16 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update17:*:*:*:*:*:* Versions 7.4 update17 Vulnerable ·Liferay
Show 78 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:*7.4 update18VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:*7.4 update19VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:*7.4 update20VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:*7.4 update21VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:*7.4 update22VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:*7.4 update23VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:*7.4 update24VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:*7.4 update25VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:*7.4 update26VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:*7.4 update27VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:*7.4 update28VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:*7.4 update29VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:*7.4 update30VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:*7.4 update31VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:*7.4 update32VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:*7.4 update33VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:*7.4 update34VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:*7.4 update35VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:*7.4 update36VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:*7.4 update37VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:*7.4 update38VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:*7.4 update39VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:*7.4 update40VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:*7.4 update41VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:*7.4 update42VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:*7.4 update43VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:*7.4 update44VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:*7.4 update45VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:*7.4 update46VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:*7.4 update47VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:*7.4 update48VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:*7.4 update49VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:*7.4 update50VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:*7.4 update51VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:*7.4 update52VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:*7.4 update53VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:*7.4 update54VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:*7.4 update55VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:*7.4 update56VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:*7.4 update57VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:*7.4 update58VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:*7.4 update59VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:*7.4 update60VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:*7.4 update61VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:*7.4 update62VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:*7.4 update63VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:*7.4 update64VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:*7.4 update65VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:*7.4 update66VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:*7.4 update67VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:*7.4 update68VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:*7.4 update69VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:*7.4 update70VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:*7.4 update71VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:*7.4 update72VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:*7.4 update73VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:*7.4 update74VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:*7.4 update75VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:*7.4 update76VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:*7.4 update77VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:*7.4 update78VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:*7.4 update79VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:*7.4 update8VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:*7.4 update80VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:*7.4 update81VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:*7.4 update82VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:*7.4 update83VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:*7.4 update84VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:*7.4 update85VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:*7.4 update86VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:*7.4 update87VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:*7.4 update88VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:*7.4 update89VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:*7.4 update9VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:*7.4 update90VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:*7.4 update91VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:*7.4 update92VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*7.4.3.8 to before 7.4.3.112VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update18:*:*:*:*:*:* Versions 7.4 update18 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update19:*:*:*:*:*:* Versions 7.4 update19 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update20:*:*:*:*:*:* Versions 7.4 update20 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update21:*:*:*:*:*:* Versions 7.4 update21 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update22:*:*:*:*:*:* Versions 7.4 update22 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update23:*:*:*:*:*:* Versions 7.4 update23 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update24:*:*:*:*:*:* Versions 7.4 update24 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update25:*:*:*:*:*:* Versions 7.4 update25 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update26:*:*:*:*:*:* Versions 7.4 update26 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update27:*:*:*:*:*:* Versions 7.4 update27 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update28:*:*:*:*:*:* Versions 7.4 update28 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update29:*:*:*:*:*:* Versions 7.4 update29 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update30:*:*:*:*:*:* Versions 7.4 update30 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update31:*:*:*:*:*:* Versions 7.4 update31 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update32:*:*:*:*:*:* Versions 7.4 update32 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update33:*:*:*:*:*:* Versions 7.4 update33 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update34:*:*:*:*:*:* Versions 7.4 update34 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update35:*:*:*:*:*:* Versions 7.4 update35 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update36:*:*:*:*:*:* Versions 7.4 update36 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update37:*:*:*:*:*:* Versions 7.4 update37 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update38:*:*:*:*:*:* Versions 7.4 update38 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update39:*:*:*:*:*:* Versions 7.4 update39 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update40:*:*:*:*:*:* Versions 7.4 update40 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update41:*:*:*:*:*:* Versions 7.4 update41 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update42:*:*:*:*:*:* Versions 7.4 update42 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update43:*:*:*:*:*:* Versions 7.4 update43 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update44:*:*:*:*:*:* Versions 7.4 update44 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update45:*:*:*:*:*:* Versions 7.4 update45 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update46:*:*:*:*:*:* Versions 7.4 update46 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update47:*:*:*:*:*:* Versions 7.4 update47 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update48:*:*:*:*:*:* Versions 7.4 update48 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update49:*:*:*:*:*:* Versions 7.4 update49 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update50:*:*:*:*:*:* Versions 7.4 update50 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update51:*:*:*:*:*:* Versions 7.4 update51 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update52:*:*:*:*:*:* Versions 7.4 update52 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update53:*:*:*:*:*:* Versions 7.4 update53 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update54:*:*:*:*:*:* Versions 7.4 update54 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update55:*:*:*:*:*:* Versions 7.4 update55 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update56:*:*:*:*:*:* Versions 7.4 update56 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update57:*:*:*:*:*:* Versions 7.4 update57 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update58:*:*:*:*:*:* Versions 7.4 update58 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update59:*:*:*:*:*:* Versions 7.4 update59 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update60:*:*:*:*:*:* Versions 7.4 update60 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update61:*:*:*:*:*:* Versions 7.4 update61 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update62:*:*:*:*:*:* Versions 7.4 update62 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update63:*:*:*:*:*:* Versions 7.4 update63 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update64:*:*:*:*:*:* Versions 7.4 update64 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update65:*:*:*:*:*:* Versions 7.4 update65 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update66:*:*:*:*:*:* Versions 7.4 update66 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update67:*:*:*:*:*:* Versions 7.4 update67 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update68:*:*:*:*:*:* Versions 7.4 update68 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update69:*:*:*:*:*:* Versions 7.4 update69 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update70:*:*:*:*:*:* Versions 7.4 update70 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update71:*:*:*:*:*:* Versions 7.4 update71 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update72:*:*:*:*:*:* Versions 7.4 update72 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update73:*:*:*:*:*:* Versions 7.4 update73 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update74:*:*:*:*:*:* Versions 7.4 update74 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update75:*:*:*:*:*:* Versions 7.4 update75 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update76:*:*:*:*:*:* Versions 7.4 update76 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update77:*:*:*:*:*:* Versions 7.4 update77 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update78:*:*:*:*:*:* Versions 7.4 update78 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update79:*:*:*:*:*:* Versions 7.4 update79 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update8:*:*:*:*:*:* Versions 7.4 update8 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update80:*:*:*:*:*:* Versions 7.4 update80 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update81:*:*:*:*:*:* Versions 7.4 update81 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update82:*:*:*:*:*:* Versions 7.4 update82 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update83:*:*:*:*:*:* Versions 7.4 update83 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update84:*:*:*:*:*:* Versions 7.4 update84 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update85:*:*:*:*:*:* Versions 7.4 update85 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update86:*:*:*:*:*:* Versions 7.4 update86 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update87:*:*:*:*:*:* Versions 7.4 update87 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update88:*:*:*:*:*:* Versions 7.4 update88 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update89:*:*:*:*:*:* Versions 7.4 update89 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update9:*:*:*:*:*:* Versions 7.4 update9 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update90:*:*:*:*:*:* Versions 7.4 update90 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update91:*:*:*:*:*:* Versions 7.4 update91 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.4:update92:*:*:*:*:*:* Versions 7.4 update92 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.3.8 to before 7.4.3.112 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-m4g9-5mg6-gfr3 com.liferay.commerce:com.liferay.commerce.order.web (Maven) Fixed in 5.0.101 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62237
  2. 2026-10-03 Alias added: GHSA-m4g9-5mg6-gfr3

References

Advisory 2

Other 2

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences