GHSA-9h7f-5hc8-cj5f

Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-35463

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay.portal:release.portal.bom	>= 7.4.0, < 7.4.1	7.4.1
Maven	com.liferay:com.liferay.frontend.taglib.clay	< 7.1.15	7.1.15

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-35463 advisory
https://github.com/liferay/liferay-portal/commit/751a70e0ed7b380ea2ab510ff79ddb33ed87dd9b web
https://github.com/liferay/liferay-portal package
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-35463-reflected-xss-with-keywords-in-searc… web