CVE-2025-62237: 
Java vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability (CVE-2025-62237) was discovered in Commerce's view order page in Liferay Portal and Liferay DXP. The vulnerability allows remote attackers to inject arbitrary web script or HTML through a crafted payload inserted into an Account's "Name" text field. The vulnerability was reported by researcher foobar7 and was published on September 16, 2024 (Liferay Security).

The vulnerability has been assigned a CVSS v4.0 score of 4.8, indicating moderate severity. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), no attack requirements (AT:N), low privileges (PR:L), and active user interaction (UI:A). The vulnerability impacts confidentiality (VC:L) and integrity (VI:L) at a low level, with no availability impact (VA:N) and no subsequent system impacts (SC:N/SI:N/SA:N) (Liferay Security).

The vulnerability allows attackers to execute arbitrary web scripts or inject HTML content through the Account Name field, potentially leading to compromised user sessions and data theft. The impact is considered low to moderate as it requires user interaction and authenticated access to exploit (Liferay Security).

The vulnerability has been patched in the following versions: Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.6, Liferay DXP 2023.Q3.9, and Liferay Portal 7.4.3.112. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).