Liferay Portal CVE-2025-62239

Exploitation requires an authenticated attacker holding high privileges (PR:H) sufficient to create or modify workflow definitions in the Liferay workflow process builder - this is not available to ordinary or unauthenticated users. The attacker injects crafted input into a workflow definition field, and exploitation further requires active user interaction (UI:A): a victim must subsequently view or render the malicious workflow element for the script to execute. These two conditions - privileged write access to workflow definitions plus a victim rendering the content - substantially limit realistic exploitation to insider abuse or scenarios where a privileged account is already compromised. Affected deployments are Liferay Portal 7.4.3.21-7.4.3.111 and Liferay DXP 2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.8, and 7.4 update 21 through update 92.

This is a genuinely low-to-medium priority issue, and the available signals are consistent rather than conflicting. The CVSS 4.0 base score of 4.6 (Medium) reflects a constrained attack: AV:N (network reachable) but PR:H (high privileges required) and UI:A (a victim must actively interact), with only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact. EPSS reinforces the low-risk picture at 0.22% (12th percentile), indicating very low near-term exploitation probability. The CVE is not listed in CISA KEV and no public exploit has been identified, so there is no evidence of active or opportunistic exploitation. The PR:H requirement is the dominant limiting factor: an attacker must already hold a privileged account capable of creating or editing workflow definitions, which confines this to malicious insiders or already-compromised administrative accounts rather than anonymous internet attackers. All primary signals (CVSS, EPSS, KEV, POC) agree this is a low-urgency, patch-in-normal-cycle vulnerability rather than an emergency.

A user with high-privilege access to the Liferay workflow process builder crafts a workflow definition containing malicious script in an input field. When another user (such as a reviewer or administrator) views the affected workflow element in their browser, the stored script executes in their session context. No public exploit code has been identified at time of analysis.