GHSA-9536-m86r-q297

Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-38264

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.frontend.taglib.clay	< 7.1.15	7.1.15

Details

As written in the advisory (Markdown source, shown as plain text).

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-38264 advisory
https://github.com/liferay/liferay-portal/commit/f5df5cbfdc8254b2388fa445e62ec1efebe3547f web
https://github.com/liferay/liferay-portal package
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38264-reflected-xss-with-keywords-in-searc… web