CVE-2025-62248: Liferay Dynamic Data Mapping Web Package Vulnerable to Reflected XSS
Summary
CVE-2025-62248: Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS). Affects com.liferay:com.liferay.dynamic.data.mapping.web versions < 5.0.122. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Dynamic Data Mapping Web package is a component of the Liferay Portal and Liferay DXP, which facilitates the creation and management of dynamic data forms and structures. This package is widely used in enterprise applications for content management and data handling. However, it has been identified to have a reflected cross-site scripting (XSS) vulnerability that can be exploited by attackers.
Vulnerability Detail
A reflected cross-site scripting (XSS) vulnerability has been identified in Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q2.0 through 2025.Q2.9, among others. This vulnerability arises from a regression that allows a remote, authenticated attacker to inject and execute JavaScript code via the '_com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition' parameter. When a victim accesses a URL containing this crafted parameter, the malicious payload is executed in their browser, potentially leading to unauthorized actions or data theft.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the '_com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition' parameter to mitigate the risk of XSS attacks. Additionally, consider restricting access to the affected functionality to trusted users only.
Conclusion
The Liferay Dynamic Data Mapping Web package has a reflected XSS vulnerability that can be exploited by attackers. It is crucial to update to the patched version to protect against potential attacks. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for com.liferay:com.liferay.dynamic.data.mapping.web →
FAQ
CVE-2025-62248 is a vulnerability in the Liferay Dynamic Data Mapping Web package that allows for reflected cross-site scripting (XSS) attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your pom.xml without signing up.
If exploited, this vulnerability could allow attackers to execute malicious scripts in the context of a user's browser, leading to data theft, session hijacking, or unauthorized actions.
Yes, a patch is available. You should update to version 5.0.123 or later of the Liferay Dynamic Data Mapping Web package to mitigate this vulnerability.
If an immediate update is not possible, implement input validation and restrict access to the affected functionality as a temporary measure.
