Skip to content
OpenAdvisories
Medium · 5.4 CVE-2021-38267 BIT-liferay-2021-38267EUVD-2021-24725GHSA-r39x-3qq4-gxmr

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page

Published Mar 2, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.frontend.js.web Package: com.liferay.portal:release.dxp.bom Package: com.liferay.portal:release.portal.bom Ecosystem: Maven

Description

Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_blogs_web_portlet_BlogsAdminPortlet_title and _com_liferay_blogs_web_portlet_BlogsAdminPortlet_subtitle parameter.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.frontend.js.web < 5.0.0 5.0.0 GHSA-r39x-3qq4-gxmr
Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.fp2 7.3.10.fp2 GHSA-r39x-3qq4-gxmr
Maven com.liferay.portal:release.portal.bom >= 7.3.2, < 7.3.7-ga8 7.3.7-ga8 GHSA-r39x-3qq4-gxmr

References