What is GHSA-xcvw-hh99-qm73?

GHSA-xcvw-hh99-qm73 is a security advisory published by GitHub Security Advisories with Medium severity. Liferay Portal is vulnerable to XSS through its workflow process builder

Which CVE IDs does GHSA-xcvw-hh99-qm73 cover?

GHSA-xcvw-hh99-qm73 covers the following CVE IDs: CVE-2025-62239. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-xcvw-hh99-qm73?

GHSA-xcvw-hh99-qm73 affects 1 product, including: maven/com.liferay:com.liferay.portal.workflow.kaleo.designer.web:\u003e= 5.0.56, \u003c 5.0.124.

GHSA-xcvw-hh99-qm73Medium

Liferay Portal is vulnerable to XSS through its workflow process builder

Vendor

GitHub Security Advisories

Published

October 10, 2025

Last Modified

October 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-62239 →

📋 Description

Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

🎯 Affected products1

maven/com.liferay:com.liferay.portal.workflow.kaleo.designer.web:>= 5.0.56, < 5.0.124

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-62239
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62239
https://github.com/liferay/liferay-portal/commit/3acad2d8683688ce022abf2dfbab9fb500c5a619
https://liferay.atlassian.net/browse/LPE-17919
https://github.com/advisories/GHSA-xcvw-hh99-qm73