Skip to content
OpenAdvisories
Medium · 5.4 CVE-2021-38269 BIT-liferay-2021-38269EUVD-2021-24727GHSA-vw6g-gh6c-8qwp

Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module

Published Mar 2, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: com.liferay:com.liferay.gogo.shell.web Package: com.liferay.portal:release.dxp.bom Ecosystem: Maven

Description

Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.liferay:com.liferay.gogo.shell.web < 5.0.2 5.0.2 GHSA-vw6g-gh6c-8qwp
Maven com.liferay.portal:release.dxp.bom >= 7.1.0, < 7.1.10.fp23 7.1.10.fp23 GHSA-vw6g-gh6c-8qwp
Maven com.liferay.portal:release.dxp.bom >= 7.2.0, < 7.2.10.fp13 7.2.10.fp13 GHSA-vw6g-gh6c-8qwp
Maven com.liferay.portal:release.dxp.bom >= 7.3.0, < 7.3.10.fp2 7.3.10.fp2 GHSA-vw6g-gh6c-8qwp

References