medium6.1
CVE-2021-29039
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page
Impact
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay.portal:release.portal.bom | = 7.3.4 | 7.3.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Liferay Portal | Version 7.3.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766
- https://github.com/advisories/GHSA-239w-4f3w-cfcv
- https://nvd.nist.gov/vuln/detail/CVE-2021-29039
- http://liferay.com
- https://web.archive.org/web/20220828222833/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766