GitHub Advisoryadvisory · Maven

GHSA-xcvw-hh99-qm73 Liferay Portal is vulnerable to XSS through its workflow process builder

MEDIUM Published 2025-10-10 Modified 2025-10-11 Official page ↗
Aliases
CVE-2025-62239
Ecosystem
Maven
Packages
com.liferay:com.liferay.portal.workflow.kaleo.designer.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-10-11

Affected packages

• Maven com.liferay:com.liferay.portal.workflow.kaleo.designer.web: >= 5.0.56, < 5.0.124 → fixed in 5.0.124

Description

Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

Related

Alias · CVE (1)

  • CVE-2025-62239 Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References