CVE-2025-62249

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-62249

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62249.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-62249

Aliases

GHSA-rx48-gqc2-4w47

Published

2025-10-21T19:21:25.203Z

Modified

2026-04-12T18:40:00.434562Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.

References

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62249

Affected packages

Git / github.com/liferay/liferay-portal

Affected ranges

Type

GIT

Repo

https://github.com/liferay/liferay-portal

Events

Introduced

ec84d86679146b84af526f96471a730c340dda78

Fixed

a9017d1f654503189fcd6eecd59bd501a7015b8c

Database specific

{
    "versions": [
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.3.132"
        }
    ]
}

Affected versions

7.*

7.4.0-ga1

7.4.1-ga2

7.4.2-ga3

7.4.3.4-ga4

7.4.3.41-ga41

7.4.3.5-ga5

7.4.3.6-ga6

7.4.3.7-ga7

7.4.3.88-ga88

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62249.json"

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "103302773237074788461801313682446763330",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464",
                "202485877113214607873722865538960039931",
                "60853900272161977226321758184551802988",
                "191378307748951099486338189471951812045",
                "164880871512209417113954673574280468464"
            ]
        },
        "id": "CVE-2025-62249-0b9fe555",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "target": {
            "file": "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java"
        }
    },
    {
        "digest": {
            "length": 2763.0,
            "function_hash": "170699539902466296749337177159259793854"
        },
        "id": "CVE-2025-62249-98b65317",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/liferay/liferay-portal/commit/a9017d1f654503189fcd6eecd59bd501a7015b8c",
        "target": {
            "function": "_upgradePortletPreferenceValues",
            "file": "portal-kernel/src/com/liferay/portal/kernel/upgrade/BasePortletPreferencesUpgradeProcess.java"
        }
    }
]

vanir_signatures_modified

"2026-04-12T18:40:00Z"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "2023.q4.0"
            },
            {
                "last_affected": "2023.q4.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.q1.1"
            },
            {
                "fixed": "2024.q1.21"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.q2.0"
            },
            {
                "last_affected": "2024.q2.13"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2024.q3.1"
            },
            {
                "last_affected": "2024.q3.13"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2025.q1.0"
            },
            {
                "fixed": "2025.q1.18"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2025.q2.0"
            },
            {
                "last_affected": "2025.q2.12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "2025.q3.0"
            },
            {
                "fixed": "2025.q3.3"
            }
        ]
    }
]