Liferay Portal CVE-2025-62267

Exploitation requires (1) the ability to set a crafted payload in a user's First, Middle, or Last name field - i.e. an account whose profile name can be modified - and (2) a victim user actively opening the web content template's 'select structure' page in an affected build, where the name value is rendered without adequate output encoding. Limiting factors: the payload only fires upon that specific administrative/authoring page being viewed (UI:A), the deployment must run one of the listed vulnerable Portal/DXP versions, and the vendor assumes elevated privileges (PR:H) to reach the injection path; impact is confined to low confidentiality and integrity in the victim's session, with no availability effect.

This is a stored cross-site scripting (CWE-79) issue in Liferay Portal 7.4.3.35-7.4.3.111 and Liferay DXP (2023.Q4.0-Q4.10, 2023.Q3.1-Q3.10, 7.4 update 35-92), rated by the vendor at CVSS 4.0 base 4.6 (medium). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N, subsequent impacts all N) describes a network-reachable but privilege- and interaction-gated flaw: PR:H means the vendor assumes the attacker already holds high privileges, UI:A means a victim must actively use the affected 'select structure' page, and impact is limited (low confidentiality and integrity, no availability). EPSS is low at 0.23% (13th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so all exploitation signals are consistent and point to low real-world urgency. One internal tension is worth flagging: the description frames injection via a user's own First/Middle/Last name fields, which in most deployments are low-privilege/self-service editable, whereas the vendor assigned PR:H - the practical privilege needed to plant the payload may be lower than PR:H implies, though delivery still depends on a privileged user opening the template select-structure page. Net assessment: a genuine but low-priority stored XSS, not a high-impact or widely-exploited threat; prioritize via normal patch cycles rather than emergency response.

An attacker with a Liferay account sets a crafted script payload in their First, Middle, or Last name field. When an administrator or content author later opens the web content template's 'select structure' page where that user's name is rendered without proper encoding, the payload executes in the privileged user's browser session. No public exploit code is identified at time of analysis, and active user interaction (viewing the affected page) is required.