GHSA-r39x-3qq4-gxmr
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | >= 7.3.2, < 7.3.7-ga8 | 7.3.7-ga8 |
| Maven | com.liferay.portal:release.dxp.bom | >= 7.3.0, < 7.3.10.fp2 | 7.3.10.fp2 |
| Maven | com.liferay:com.liferay.frontend.js.web | < 5.0.0 | 5.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-38267
- https://github.com/liferay/liferay-portal/commit/c3ad74d0664072c43da4d30a1d19be8cec3aa8bc
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-17212
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38267-stored-xss-with-title-and-subtitle-o…