TI-2025-38557 Aliases CVE-2025-62248 GHSA-phjr-p9c5-hprx

Cross-site scripting in Liferay Portal

LOW 22CWE-79Published 2025-10-22 · Updated 2025-10-22

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. The malicious payload is executed within the victim's browser when they access a URL that includes the crafted parameter.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00237 14th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Liferay	Portal	7.4.0 – 7.4.3.132	—	No fix listed	CNA
Liferay	DXP	2024.Q1.1 – 2024.Q1.19; 2024.Q2.1 – 2024.Q2.13; 2024.Q3.1 – 2024.Q3.13; 2024.Q4.0 – 2024.Q4.7; 2025.Q1.0 – 2025.Q1.16; 2025.Q2.0 – 2025.Q2.9	—	No fix listed	CNA
—	com.liferay:com.liferay.dynamic.data.mapping.web (Maven)	up to 5.0.122	—	No fix listed	GHSA-phjr-p9c5-hprx

Portal VendorLiferay Affected 7.4.0 – 7.4.3.132 Fixed in — No fix listed CNA
DXP VendorLiferay Affected 2024.Q1.1 – 2024.Q1.19; 2024.Q2.1 – 2024.Q2.13; 2024.Q3.1 – 2024.Q3.13; 2024.Q4.0 – 2024.Q4.7; 2025.Q1.0 – 2025.Q1.16; 2025.Q2.0 – 2025.Q2.9 Fixed in — No fix listed CNA
com.liferay:com.liferay.dynamic.data.mapping.web (Maven) Vendor— Affected up to 5.0.122 Fixed in — No fix listed GHSA-phjr-p9c5-hprx

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:liferay:digital_experience_platform::::::::	2024.q1.1 to before 2024.q1.20; 2024.q2.0 – 2024.q2.13; 2024.q3.1 – 2024.q3.13; 2024.q4.0 – 2024.q4.7	Vulnerable	Liferay
cpe:2.3:a:liferay:liferay_portal::::::::	7.4.0 – 7.4.3.132	Vulnerable	Liferay

cpe:2.3:a:liferay:digital_experience_platform:*:*:*:*:*:*:*:* Versions 2024.q1.1 to before 2024.q1.20; 2024.q2.0 – 2024.q2.13; 2024.q3.1 – 2024.q3.13; 2024.q4.0 – 2024.q4.7 Vulnerable ·Liferay
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:* Versions 7.4.0 – 7.4.3.132 Vulnerable ·Liferay

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-62248
2026-10-03 Alias added: GHSA-phjr-p9c5-hprx

References

Advisory 2

Other 3

TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6

See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences