CVE-2025-62246: digital experience platform through 7.4 (inclusive), from 2023.q3.1 (inclusive), before 2023.q3.9 (exclusive), from…

Affected technology

digital experience platform · through 7.4 (inclusive)
liferay

digital experience platform · from 2023.q3.1 (inclusive), before 2023.q3.9 (exclusive)
liferay

digital experience platform · from 2023.q4.0 (inclusive), before 2023.q4.6 (exclusive)
liferay

liferay portal · from 7.1.0 (inclusive), before 7.4.3.112 (exclusive)
liferay

Portal · 7.4.0 through 7.4.3.111
Liferay

DXP · 7.4.13 through 7.4.13-u92, 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5
Liferay

Description’s affected range: through 7.4.3.111

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

Remote authenticated users can inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or last name text field to (1) page comments widget, (2) blog entry comments, (3) document and media document comments, (4) message board messages, (5) wiki page comments or (6) other widgets/apps that supports mentions. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality, integrity and availability impact as low.