Liferay Portal CVE-2025-62248

Exploitation requires an authenticated attacker holding HIGH privileges within the Liferay instance (PR:H) who injects a payload into the specific _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter of the Dynamic Data Mapping (DDM) portlet, plus a victim who must actively open the crafted URL (UI:P/required user interaction). Affected deployments are Liferay Portal 7.4.0 through 7.4.3.132 and Liferay DXP across the 2024.Q1-2025.Q2 quarterly release lines; the flaw is a regression, so instances previously patched for related XSS should not be assumed safe. Limiting factors that reduce realistic risk: the required privileged account, the mandatory victim click, reflected (non-persistent) nature meaning each victim must be individually targeted, and impact confined to a low confidentiality effect within the browser session (no integrity or availability impact per the vector).

This is a moderate-severity reflected XSS (CWE-79) with multiple converging signals pointing to LOW real-world urgency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L) yields only 4.8, driven down by two significant barriers: PR:H (the authenticated attacker needs HIGH privileges - i.e. an existing privileged/admin-level account in the portal) and UI:P (a victim must be lured into clicking a crafted URL). EPSS reinforces this: 0.24% probability (14th percentile) indicates very low expected exploitation volume. There is no CISA KEV listing and no public exploit code identified, so there is no evidence of active exploitation. The signals are internally consistent - low CVSS, low EPSS, no KEV, no POC all agree this is NOT a priority patch relative to critical/unauthenticated flaws. One nuance worth flagging: PR:H is unusually high for a reflected XSS, which normally needs no privileges; this strongly implies the vulnerable DDMPortlet definition parameter sits behind an authenticated/administrative portlet, materially shrinking the attacker population to users who already hold elevated access. The 'regression' noted in the description also means a previously-fixed issue reappeared, so environments that trusted prior remediation should re-verify. Overall: a genuine but low-priority bug - patch in routine cycles, not as an emergency.

A remote attacker who already holds a privileged (PR:H) Liferay account crafts a URL containing a malicious JavaScript payload in the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter and sends it to another authenticated user. When that victim opens the link, the unsanitized parameter is reflected into the response and the script executes in their browser session, enabling session-context actions such as cookie/token theft or UI manipulation. No public exploit code has been identified at time of analysis.