Skip to content
OpenAdvisories
Medium · 6.1 CVE-2021-35463 EUVD-2021-22105GHSA-9h7f-5hc8-cj5f

Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module

Published Aug 4, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: com.liferay:com.liferay.frontend.taglib.clay Package: com.liferay.portal:release.portal.bom Ecosystem: Maven

Description

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.frontend.taglib.clay < 7.1.15 7.1.15 GHSA-9h7f-5hc8-cj5f
Maven com.liferay.portal:release.portal.bom >= 7.4.0, < 7.4.1 7.4.1 GHSA-9h7f-5hc8-cj5f

References