CVE-2025-62237: Liferay DXP Stored XSS Vulnerability

CVE-2025-62237 Overview

CVE-2025-62237 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the Commerce view order page in Liferay Portal and Liferay Digital Experience Platform (DXP). An authenticated attacker can inject arbitrary HTML or JavaScript through an Account's Name text field. When another user visits the affected view order page, the injected payload executes in the victim's browser session.

Critical Impact
Authenticated attackers can execute arbitrary scripts in the browsers of users viewing affected order pages, potentially enabling session theft, credential harvesting, and unauthorized actions within the Liferay Commerce context.

Affected Products

Liferay Portal 7.4.3.8 through 7.4.3.111
Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
Liferay DXP 7.4 update 8 through update 92

Discovery Timeline

2025-10-10 - CVE-2025-62237 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62237

Vulnerability Analysis

The flaw resides in how the Liferay Commerce view order page renders Account metadata. The Name field on an Account is stored without adequate sanitization and later reflected into the order view without proper output encoding. Because the payload is persisted in the Account record, every subsequent render of an affected order triggers the script in the viewer's authenticated session.

Exploitation requires low-privilege authentication and user interaction, since a victim must load the view order page. The stored nature of the vulnerability makes it useful for targeting administrators or commerce operators who routinely review customer orders.

Root Cause

The underlying weakness is improper neutralization of input during web page generation [CWE-79]. User-supplied content in the Account Name field is not encoded when written to the Document Object Model (DOM) of the view order page. HTML control characters such as <, >, and quotation marks pass through untouched, allowing script tags or event handler attributes to render as executable markup.

Attack Vector

An attacker with an authenticated Commerce account creates or updates an Account and places a crafted payload into the Name field. The payload persists in the datastore. When a privileged user, such as a store administrator or order processor, opens the corresponding order in the Commerce view order page, the payload executes with that user's session context. This enables actions such as exfiltrating session cookies, forging administrative requests, or pivoting to other Commerce workflows.

No verified public proof-of-concept code is available. Refer to the Liferay Security Advisory CVE-2025-62237 for vendor technical details.

Detection Methods for CVE-2025-62237

Indicators of Compromise

Account records containing HTML tags, JavaScript URIs, or event handler attributes (for example onerror=, onload=, <script>) in the Name field.
Outbound requests from administrator browsers to unfamiliar domains immediately after loading a Commerce order.
Unexpected session token usage or administrative actions originating from a legitimate user's session shortly after order review.

Detection Strategies

Query the Commerce Account table for Name values that match a regular expression detecting angle brackets, javascript: schemes, or common XSS event handlers.
Deploy Content Security Policy (CSP) reporting to capture script-src violations generated by injected payloads on Commerce pages.
Review web application firewall (WAF) logs for POST requests to Account creation or update endpoints containing script-like content in the name parameter.

Monitoring Recommendations

Alert on modifications to Commerce Account records that contain HTML metacharacters in identity fields.
Correlate administrative user browser telemetry with anomalous outbound HTTP requests triggered from Liferay Commerce views.
Enable and centralize Liferay audit logs covering Account create, update, and view events for continuous review.

How to Mitigate CVE-2025-62237

Immediate Actions Required

Upgrade Liferay Portal to a version later than 7.4.3.111 and Liferay DXP to a release beyond the affected 2023.Q3, 2023.Q4, and 7.4 update ranges listed in the vendor advisory.
Audit existing Commerce Account Name values for injected markup and sanitize or remove offending entries.
Restrict Account creation and modification privileges to trusted Commerce users pending patch deployment.

Patch Information

Liferay has published remediation guidance in the Liferay Security Advisory CVE-2025-62237. Apply the fixed Portal and DXP releases identified in the advisory. Customers on DXP subscription channels should install the corresponding service pack or quarterly release update from the Liferay Customer Portal.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts on Commerce pages until patches are applied.
Configure a WAF rule to reject Account create and update requests containing <script, javascript:, or common event handler attributes in the name parameter.
Temporarily limit which roles can view or process orders in the Commerce module to reduce the pool of potential victims.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in Account name submissions
SecRule ARGS:name "@rx (?i)(<script|javascript:|on(error|load|click|mouseover)\s*=)" \
    "id:1006237,phase:2,deny,status:400,log,msg:'Potential XSS in Liferay Account name (CVE-2025-62237)'"