CVE-2025-62263: Liferay Portal XSS Vulnerabilities in Account and Organization Management
Summary
CVE-2025-62263: Liferay Portal Vulnerable to Cross-Site Scripting. Affects com.liferay:com.liferay.account.admin.web versions >= 2.0.0, < 2.0.108. Fixed in 2.0.108. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing digital experiences. It provides a suite of tools for content management, collaboration, and user management. The affected package, com.liferay:com.liferay.account.admin.web, is responsible for managing account roles and organizations within the portal. This package is crucial for maintaining user permissions and organizational structures, making it a vital component for any Liferay implementation.
Vulnerability Detail
The vulnerability arises from multiple cross-site scripting (XSS) flaws in Liferay Portal versions 7.3.7 through 7.4.3.103, and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4. Attackers can exploit these vulnerabilities by injecting arbitrary web scripts or HTML into the 'Title' field of an Account Role or the 'Name' field of an Organization. This could allow an attacker to manipulate the content displayed to users, potentially leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
2.0.108
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider sanitizing user inputs in the 'Title' and 'Name' fields to prevent the execution of malicious scripts. Implementing input validation can help mitigate the risk until the package is updated.
Conclusion
The identified vulnerabilities in Liferay Portal pose significant risks due to their potential for exploitation via XSS attacks. It is crucial for users of the affected versions to apply the necessary updates to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for com.liferay:com.liferay.account.admin.web →
FAQ
The vulnerabilities are cross-site scripting (XSS) flaws that allow attackers to inject malicious scripts into web pages.
Liferay Portal versions 7.3.7 through 7.4.3.103 and Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 are affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploiting this vulnerability could lead to unauthorized access, data exposure, or manipulation of user sessions.
Yes, a patch is available in version 2.0.108 of the affected package. It is recommended to update to this version.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.account.admin.web.
