Liferay Portal CVE-2025-62263

Exploitation requires an authenticated Liferay user (PR:L) who holds permissions to create or edit an Account Role (to control its 'Title' text field) or an Organization (to control its 'Name' text field) - i.e., account/organization administration rights, not an anonymous visitor. The stored payload only fires when a second user actively navigates to the affected pages: the view account role page or select account role page (Title vector), or the view account page, view account organization page, or select account organization page (Name vector) - this is the UI:A/victim-interaction requirement. Limiting factors: the attacker must already have role/organization-management privileges, a victim must open the specific affected admin page, impact is low (session/context in the victim browser) with no availability loss, and only the listed Liferay Portal 7.3.7-7.4.3.103 and DXP builds (2023.Q3.1-Q3.4, 7.4 GA-update 92, 7.3 SP3-update 36) are affected.

This is a genuine but low-to-moderate priority stored cross-site scripting (XSS, CWE-79) issue, not a critical emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N) scores 4.8 (Medium): network-reachable and low attack complexity, but it requires an authenticated attacker with low privileges (PR:L) AND active victim interaction (UI:A), and impact is limited to low confidentiality and low integrity with no availability impact and no scope change in the 4.0 metrics. The EPSS score is low at 0.22% (12th percentile), indicating a low modeled probability of exploitation in the next 30 days, which is consistent with a stored XSS that depends on privileged injection plus a victim viewing a specific admin page. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no public exploit identified at time of analysis. All signals are mutually consistent here - low EPSS, no KEV, authenticated-plus-interaction CVSS - pointing to a real-but-contained defense-in-depth fix rather than an urgent widespread threat. Note one minor cross-source nuance: the description calls these 'remote attackers,' but the CVSS PR:L confirms the injection step is authenticated, so 'remote' should be read as network-reachable, not unauthenticated.

An attacker who already holds a low-privileged Liferay account with permission to create or edit an Account Role or an Organization inserts a malicious script payload into the Account Role 'Title' field or the Organization 'Name' field. When a victim - typically an administrator or another user - later opens the view/select account role page or the account/organization page, the stored script executes in their browser session. No public exploit code is identified in the provided data, but the technique is a straightforward stored XSS.