medium4.8
CVE-2025-62237
Liferay Portal Commerce is vulnerable to XSS through account "name" field
Impact
Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay.commerce:com.liferay.commerce.order.web | >= 5.0.29, < 5.0.101 | 5.0.101 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Digital Experience Platform | from 2023.q3.1 before 2023.q3.9 from 2023.q4.0 before 2023.q4.6 Version 7.4 |
| Liferay | Liferay Portal | from 7.4.3.8 before 7.4.3.112 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62237
- https://github.com/advisories/GHSA-m4g9-5mg6-gfr3
- https://nvd.nist.gov/vuln/detail/CVE-2025-62237
- https://github.com/liferay/liferay-portal/commit/e6d49eda196676aa3fecb26f6a8ba100602d0c36