Liferay Portal CVE-2025-62264

Exploitation requires that an authenticated-not-needed victim with access to the Liferay Language Override functionality click an attacker-crafted URL containing a script payload in the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId parameter; the attacker injects nothing server-side but relies on the reflected response. The key LIMITING factor is mandatory user interaction (UI:A) - the victim must be socially engineered into following the malicious link - meaning there is no silent or automatable mass exploitation. Affected deployments are Liferay Portal 7.4.3.8 through 7.4.3.111 and Liferay DXP 2023.Q4.0-2023.Q4.10, 2023.Q3.1-2023.Q3.10, and 7.4 update 4 through update 92; instances outside these version ranges or already patched are not exploitable. Impact is further bounded to the victim's browser session (low confidentiality/integrity, no availability, no scope change).

This is a medium-severity reflected cross-site scripting flaw (CWE-79) carrying a vendor CVSS 4.0 base score of 5.1. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N) signals a network-reachable, low-complexity issue requiring NO authentication (PR:N) but DOES require active user interaction (UI:A) - the victim must follow an attacker-crafted link, which is the primary factor limiting real-world impact. Impact is limited to low confidentiality and low integrity on the vulnerable system with no availability impact and no scope/subsequent-system effect. Exploitation signals are weak-to-neutral: EPSS is 0.24% (14th percentile), indicating low predicted exploitation probability; there is NO CISA KEV listing and NO public exploit code identified, so the status is 'no public exploit identified at time of analysis.' There is no conflict between the signals - the moderate CVSS, low EPSS, and absence of KEV/POC all point consistently to a genuine but low-priority web-application flaw rather than an urgent threat. This is characteristic of reflected XSS: dangerous in targeted phishing/social-engineering contexts but not a mass-exploitation or self-propagating risk. Prioritize patching during normal maintenance cycles, especially for internet-facing Liferay instances, but it does not warrant emergency response.

An attacker crafts a malicious URL targeting a Liferay Portal/DXP instance with a script payload in the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId parameter and delivers it to a victim via phishing or a malicious link. When the victim clicks it, the unsanitized value is reflected into the Language Override response and the script executes in the victim's browser session, potentially stealing session tokens or performing actions in the Liferay context. No public exploit code has been identified, so an attacker would need to develop the payload independently, and the attack fails unless the victim interacts with the link.