PT-2021-18047 · Liferay · Liferay Dxp

Published 2021-06-09 · Updated 2025-05-13 · CVE-2021-29049

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Liferay DXP versions 7.0 through 7.0 before fix pack 99 Liferay DXP versions 7.1 through 7.1 before fix pack 23 Liferay DXP versions 7.2 through 7.2 before fix pack 12 Liferay DXP versions 7.3 through 7.3 before fix pack 1

Description: A cross-site scripting (XSS) issue exists in the Portal Workflow module's edit process page, allowing remote attackers to inject arbitrary web script or HTML via the currentURL parameter.

Recommendations: For Liferay DXP version 7.0 before fix pack 99, update to fix pack 99 or later. For Liferay DXP version 7.1 before fix pack 23, update to fix pack 23 or later. For Liferay DXP version 7.2 before fix pack 12, update to fix pack 12 or later. For Liferay DXP version 7.3 before fix pack 1, update to fix pack 1 or later. As a temporary workaround, consider restricting access to the currentURL parameter in the affected API endpoint until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-29049

GHSA-W28V-87G6-CJR6

Affected Products

Liferay Dxp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-29049 · Security Note
• http://liferay.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29049 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17211 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w28v-87g6-cjr6 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/122020 · Telegram Post
• https://t.me/cvenotify/16423 · Telegram Post