N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62263

CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role page.

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Organization’s “Name” text field to (1) view account page, (2) view account organization page, or (3) select account organization page.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62263

CVE-2025-62263:

N/A

CVSS Score

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.account.admin.web	maven	>= 2.0.0, < 2.0.108	2.0.108

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Liferay Portal's account management features. The root cause is the failure to properly sanitize user-controlled input before it is rendered on various pages. Specifically, the 'Title' of an Account Role and the 'Name' of an Organization can be crafted to contain malicious JavaScript code.

The analysis of the provided patches shows that several JSP (JavaServer Pages) files were modified to fix this vulnerability. These JSP files are responsible for rendering the views for managing and viewing accounts, roles, and organizations. Before the patch, these pages would directly render the names and descriptions of roles and organizations, leading to the execution of any embedded scripts. The fix consistently involves wrapping the output of the getter methods (e.g., getName(), getDescription(), getOrganizationNames()) with HtmlUtil.escape(). This function neutralizes any HTML or script tags, ensuring they are displayed as plain text rather than being executed by the browser.

The vulnerable functions identified are the _jspService methods of the servlets generated from the patched JSP files. These methods are the entry points for the rendering logic where the unescaped data was being processed and would be the functions appearing in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

org.apache.jsp.account_entries_admin.account_entry.view_account_organizations_jsp._jspService

modules/apps/account/account-admin-web/src/main/resources/META-INF/resources/account_entries_admin/account_entry/view_account_organizations.jsp

This JSP page, which is responsible for displaying the organizations associated with an account, was vulnerable to XSS. It rendered the organization's name without proper HTML escaping. An attacker could inject a malicious script into an organization's name, which would then be executed in the browser of any user viewing this page. The patch remediates this by explicitly escaping the organization's name using `HtmlUtil.escape()` before it is rendered.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting

CVE-2025-62263:

N/A

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

Basic Information

Basic Information

N/A

N/A

CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting

CVE-2025-62263:

N/A

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Basic Information

Basic Information

N/A

N/A

CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI