GHSA-3x83-whxw-pvmg

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-38265

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.layout.admin.web	< 5.0.0	5.0.0
Maven	com.liferay.portal:release.dxp.bom	<= 7.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Liferay Layout Admin Web before 5.0.0 in Liferay Portal v7.3.6 and below and Liferay DXP v7.3 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-38265 advisory
https://github.com/liferay/liferay-portal/commit/ac8267406785c2e70f4b15aadd604fbe7fb4451b web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-17229 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38265-stored-xss-with-collection-name?p_r_… web