Medium · 5.4 CVE-2021-38265 BIT-liferay-2021-38265EUVD-2021-24723GHSA-3x83-whxw-pvmg

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

Published Mar 2, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.layout.admin.web Package: com.liferay.portal:release.dxp.bom Ecosystem: Maven

Description

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.liferay:com.liferay.layout.admin.web	< 5.0.0	5.0.0	GHSA-3x83-whxw-pvmg
Maven	com.liferay.portal:release.dxp.bom	<= 7.3	—	GHSA-3x83-whxw-pvmg

References

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name