medium6.1
CVE-2021-38263
Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console
Impact
Liferay Server Admin Web before 4.0.12 from Liferay Portal v7.3.2 and below and Liferay DXP v7.0 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the script console under the Server module.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.liferay:com.liferay.server.admin.web | < 4.0.12 | 4.0.12 |
| maven | com.liferay.portal:release.dxp.bom | <= 7.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liferay | Liferay Portal | through 7.3.2 |
| Liferay | Digital Experience Platform | Versions 7.0, 7.1, 7.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://issues.liferay.com/browse/LPE-17061
- https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-page
- https://github.com/advisories/GHSA-ffmm-5ww2-g3q4
- https://nvd.nist.gov/vuln/detail/CVE-2021-38263
- http://liferay.com
- https://github.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f6
- https://github.com/liferay/liferay-portal/commit/771d99805b7ca69fecfcf67be5e24f2c1af1d0bb
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38263-reflected-xss-with-script-page?p_r_p_assetEntryId=121611737&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611737%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse