~ / search / GHSA-v88g-7fx4-9q7f

GHSA-v88g-7fx4-9q7f

Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33337

Packages

EcosystemPackageAffectedFixed in
Maven com.liferay:com.liferay.document.library.web >= 5.0.6, < 5.0.54 5.0.54
Maven com.liferay.portal:release.dxp.bom >= 7.1.0, < 7.1.10.fp20 7.1.10.fp20
Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp9 7.2.10.fp9

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu versions 5.0.6 to before 5.0.54, in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.

References

External links from the advisory. They lead to third-party sites.