CVE-2025-62249: Liferay Portal XSS Vulnerability in Google Gadget
Summary
CVE-2025-62249: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget. Affects com.liferay.portal:com.liferay.portal.impl versions < 114.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing content. It provides a robust framework for creating customizable user experiences and offers features such as user management, content management, and integration capabilities. However, certain versions of Liferay Portal are susceptible to a reflected cross-site scripting (XSS) vulnerability, which can be exploited by attackers to inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability arises from improper validation of user input in the google_gadget component of Liferay Portal versions 7.4.0 through 7.4.3.132 and various versions of Liferay DXP. This flaw allows remote, non-authenticated attackers to inject JavaScript code into the application, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerability is classified under CWE-79, indicating its nature as a cross-site scripting issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization measures to mitigate the risk of XSS attacks. This may involve encoding user inputs and ensuring that any dynamic content is properly escaped before being rendered in the browser.
Conclusion
The CVE-2025-62249 vulnerability poses a significant risk to users of Liferay Portal and Liferay DXP. It is crucial for organizations to update their software to the latest versions to mitigate potential attacks. Utilizing tools like Vulert can help in monitoring and alerting for such vulnerabilities in real-time.
See every vulnerability recorded for com.liferay.portal:com.liferay.portal.impl →
FAQ
CVE-2025-62249 is a reflected cross-site scripting vulnerability found in specific versions of Liferay Portal and Liferay DXP, allowing attackers to inject malicious JavaScript.
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.132 and various versions of Liferay DXP from 2023 to 2025.
You can use Vulert, a tool that monitors open-source vulnerabilities by analyzing your pom.xml file. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data theft, and the execution of malicious scripts in the context of the user's browser.
Yes, upgrading to Liferay Portal version 7.4.4 or later will patch this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:com.liferay.portal.impl.
