GitHub Advisoryadvisory · Maven

GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget

MEDIUM Published 2025-10-30 Modified 2025-10-31 Official page ↗
Aliases
CVE-2025-62265
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-10-31

Affected packages

• Maven com.liferay.portal:release.portal.bom: >= 7.4.0-ga1, < 7.4.3.112-ga112 → fixed in 7.4.3.112-ga112

Description

Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted injected into a blog entry's “Content” text field. The Blogs widget in Liferay DXP does not add the sandbox attribute to elements, which allows remote attackers to access the parent page via scripts and links in the frame page.

Related

Alias · CVE (1)

  • CVE-2025-62265 Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References