GitHub Advisoryadvisory · Maven

GHSA-gccf-r9xp-x8jx Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

LOW Published 2025-10-23 Modified 2025-10-23 Official page ↗
Aliases
CVE-2025-62255
Ecosystem
Maven
Packages
com.liferay:com.liferay.knowledge.base.web
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-10-23

Affected packages

• Maven com.liferay:com.liferay.knowledge.base.web: < 5.0.109 → fixed in 5.0.109

Description

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.

Related

Alias · CVE (1)

  • CVE-2025-62255 Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References