Liferay DXP CVE-2025-62240

Exploitation requires an authenticated Liferay account with the ability to edit one's own First, Middle, or Last Name (PR:L), and the injected payload only fires when another user actively views a Calendar event that renders the attacker's name (UI:A). The affected deployments are Liferay Portal 7.4.3.35 through 7.4.3.111 and Liferay DXP 2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.7, 7.4 update 35-92, and 7.3 update 25-36. Limiting factors: this is stored XSS confined to the Calendar events feature, impact is scoped to the victim's browser/session rather than the server, required victim interaction gates the attack, and the attacker must already hold a (low-privileged) account, so anonymous/unauthenticated exploitation is not possible.

This is a genuinely medium/low-priority issue rather than a high-urgency one, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) yields only 4.8, reflecting that exploitation requires an authenticated account (PR:L) plus active victim interaction (UI:A) and produces only Low confidentiality/integrity impact with no availability impact - hallmarks of a stored XSS, not a server compromise. EPSS corroborates the low urgency at 0.22% (12th percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT on CISA KEV and no public exploit code was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. No signals conflict: a self-service field (user's own name) feeding stored XSS is a believable but relatively constrained vector, and all indicators (low CVSS, low EPSS, no KEV, no POC) point the same direction. The main caveat is reach - because the malicious name renders in Calendar events seen by other users, a low-privileged insider could target higher-privileged viewers, so treat it as a patch-in-normal-cycle item rather than an emergency.

An authenticated low-privileged user sets a crafted script payload as their First, Middle, or Last Name. When another user - potentially an administrator - views a Calendar event associated with that user, the stored script executes in the victim's browser session in the context of the Liferay application. No public proof-of-concept exploit was provided in the input.