Liferay Portal CVE-2025-62249

Exploitation requires the attacker to deliver a crafted request/URL that reaches the google_gadget functionality of a Liferay Portal (7.4.0-7.4.3.132) or Liferay DXP (listed 2023.Q4 through 2025.Q3 quarterly releases) instance; the attacker needs no authentication (PR:N). As a REFLECTED XSS, the practical limiting factor is victim interaction - a targeted user must open the attacker-supplied link for the payload to execute in their browser - so impact is bounded to the victim's session context rather than server compromise. The vendor vector's UI:N understates this required interaction. Exploitation is further limited to deployments that expose the google_gadget feature.

This is a medium-severity reflected XSS (CWE-79) with a vendor-assigned CVSS 4.0 score of 6.9. The signals are largely consistent and point to a moderate, not urgent, priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation, which raises the ceiling - but the EPSS score is low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit was identified, so real-world exploitation pressure is currently low. One notable conflict: the vendor-supplied CVSS 4.0 vector sets UI:N (no user interaction), yet the vulnerability is explicitly a REFLECTED XSS, which by definition requires a victim to follow an attacker-crafted request/link - UI:N appears optimistic and the practical requirement is passive user interaction; verify with the Liferay advisory. Impact is limited (VC:L/VI:L, VA:N), consistent with script execution in a victim's browser session rather than full system compromise. Net: a legitimate issue to patch on normal cadence, not a high-real-risk emergency.

An attacker crafts a malicious URL targeting the google_gadget component of a victim's Liferay Portal/DXP instance, embedding JavaScript that reflects into the response. When an authenticated portal user is lured into clicking the link, the script executes in their browser in the context of the Liferay session, enabling session/token theft or actions on the user's behalf. No public exploit code was identified at time of analysis.