VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Oct 21, 2025· Updated Oct 21, 2025

CVE-2025-62249

CVE-2025-62249

Description

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay.portal:com.liferay.portal.implMaven
<= 114.1.0—

Affected products

2

Patches

3
8309d01f1511

LPD-63827 Rename

https://github.com/liferay/liferay-portalBrian ChanSep 16, 2025via ghsa
commit
1 file changed · +1 −1
  • portal-impl/test/unit/com/liferay/portal/servlet/GoogleGadgetServletTest.java+1 −1 modified
    @@ -44,7 +44,7 @@ public void setUp() {
 	}
 
 	@Test
-	public void testEscape() throws Exception {
+	public void testGetContent() throws Exception {
 		String injection =
 			"x\"/><x:script xmlns:x=\"http:&#x2f;&#x2f;www.w3.org/1999" +
 				"/xhtml\">alert(document.domain)</x:script>";
f041e7058929

LPD-63827 change it to escapeAttribute instead of escape

https://github.com/liferay/liferay-portalAkhash RAug 28, 2025via ghsa
commit
1 file changed · +1 −1
  • portal-impl/src/com/liferay/portal/servlet/GoogleGadgetServlet.java+1 −1 modified
    @@ -103,7 +103,7 @@ protected String getContent(HttpServletRequest httpServletRequest)
 		sb.append("<Content type=\"html\">");
 		sb.append("<![CDATA[");
 		sb.append("<iframe frameborder=\"0\" height=\"100%\" src=\"");
-		sb.append(HtmlUtil.escape(widgetURL));
+		sb.append(HtmlUtil.escapeAttribute(widgetURL));
 		sb.append("\" width=\"100%\">");
 		sb.append("</iframe>");
 		sb.append("]]>");
66c51e026f7c

LPD-63827 Escape title

https://github.com/liferay/liferay-portalAkhash RAug 26, 2025via ghsa
commit
1 file changed · +1 −1
  • portal-impl/src/com/liferay/portal/servlet/GoogleGadgetServlet.java+1 −1 modified
    @@ -100,7 +100,7 @@ protected String getContent(HttpServletRequest httpServletRequest)
 		sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
 		sb.append("<Module>");
 		sb.append("<ModulePrefs title=\"");
-		sb.append(title);
+		sb.append(HtmlUtil.escapeAttribute(title));
 		sb.append("\"/>");
 		sb.append("<Content type=\"html\">");
 		sb.append("<![CDATA[");

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.