CVE-2025-62238: XSS Vulnerability in com.liferay.account.admin.web Package
Summary
CVE-2025-62238: Liferay Portal's Membership page is vulnerable to XSS through “name“ text field. Affects com.liferay:com.liferay.account.admin.web versions >= 2.0.40, < 2.0.114. Fixed in 2.0.114. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.liferay.account.admin.web package is part of the Liferay Portal, a popular open-source platform for building web applications and managing content. This package specifically handles account administration functionalities, including user management and settings. The vulnerability in question affects the Membership page within Account Settings, allowing for potential security risks if not addressed.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists on the Membership page in Account Settings of Liferay Portal versions 7.4.3.21 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92. This vulnerability allows remote authenticated attackers to inject arbitrary web scripts or HTML into the 'Name' text field of an Account, potentially leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
2.0.114
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that user input is properly sanitized and validated before being processed or displayed. This can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2025-62238 vulnerability in the com.liferay.account.admin.web package poses a significant risk due to its potential for XSS attacks. It is crucial for users of affected versions to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for com.liferay:com.liferay.account.admin.web →
FAQ
CVE-2025-62238 is a vulnerability identifier that refers to a stored XSS vulnerability in the com.liferay.account.admin.web package.
If your application uses the affected versions of the com.liferay.account.admin.web package, it could allow attackers to inject malicious scripts, potentially compromising user data and application integrity.
The vulnerability affects Liferay Portal versions 7.4.3.21 through 7.4.3.111 and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml file, you can check for vulnerabilities without needing to install any software.
Vulert is a tool that helps monitor open-source vulnerabilities in real-time using just the pom.xml file. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.account.admin.web.
