N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62238

CVE-2025-62238: Liferay Portal's Membership page is vulnerable to XSS through “name“ text field

Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62238

CVE-2025-62238:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.account.admin.web	maven	>= 2.0.40, < 2.0.114	2.0.114

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability is based on the provided patch for CVE-2025-62238. The vulnerability is a stored Cross-Site Scripting (XSS) issue on the Membership page in Liferay Portal, caused by the failure to escape an account's 'name' before rendering it on the page. The commit 89a043bface29bf924e25d1c2c3b05f85d750a75 directly addresses this issue.

The patch modifies the JSP file modules/apps/account/account-admin-web/src/main/resources/META-INF/resources/common/common_user_account_entries.jsp. The change from using property="name" to value="<%= HtmlUtil.escape(accountEntryDisplay.getName()) %>" within a <liferay-ui:search-container-column-text> tag is the core of the fix. This explicitly shows that the value returned by accountEntryDisplay.getName() was previously being rendered unescaped.

During exploitation, a profiler would capture the call to the function that retrieves the malicious data. In this case, accountEntryDisplay.getName() is that function. While the class AccountEntryDisplay and its full package com.liferay.account.admin.web.internal.display are inferred based on the context of the affected module (com.liferay.account.admin.web) and common Liferay naming conventions, it is a high-confidence inference. The getName() method is the source of the tainted data that, when rendered by the JSP, results in the execution of arbitrary scripts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.