Moderate severityNVD Advisory· Published Oct 10, 2025· Updated Oct 10, 2025
CVE-2025-62238
CVE-2025-62238
Description
Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay:com.liferay.account.admin.webMaven | >= 2.0.40, < 2.0.114 | 2.0.114 |
Affected products
2- Liferay/DXPv5Range: 7.4.13-u21
Patches
189a043bface2LPD-15224 Escape account name
1 file changed · +1 −1
modules/apps/account/account-admin-web/src/main/resources/META-INF/resources/common/common_user_account_entries.jsp+1 −1 modified@@ -96,7 +96,7 @@ boolean singleSelect = ParamUtil.getBoolean(request, "singleSelect", true); <liferay-ui:search-container-column-text cssClass="table-cell-expand" name="name" - property="name" + value="<%= HtmlUtil.escape(accountEntryDisplay.getName()) %>" /> <liferay-ui:search-container-column-text
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-xw6m-3m5q-mxpmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-62238ghsaADVISORY
- github.com/liferay/liferay-portal/commit/89a043bface29bf924e25d1c2c3b05f85d750a75ghsaWEB
- liferay.atlassian.net/browse/LPE-17920ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62238ghsaWEB
News mentions
0No linked articles in our index yet.