PT-2021-18048 · Liferay · Liferay Portal+1

Published

2021-05-17

·

Updated

2025-05-13

·

CVE-2021-29051

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.1 through 7.3.5 Liferay DXP versions 7.1 before fix pack 21 Liferay DXP versions 7.2 before fix pack 10 Liferay DXP versions 7.3 before fix pack 1
Description: A cross-site scripting (XSS) issue exists in the Asset module's Asset Publisher app, allowing remote attackers to inject arbitrary web script or HTML via the com liferay asset publisher web portlet AssetPublisherPortlet INSTANCE XXXXXXXXXXXX assetEntryId parameter. This enables attackers to execute malicious scripts on the victim's browser.
Recommendations: For Liferay Portal versions 7.2.1 through 7.3.5, update to a version outside of this range to resolve the issue. For Liferay DXP version 7.1, apply fix pack 21 or later. For Liferay DXP version 7.2, apply fix pack 10 or later. For Liferay DXP version 7.3, apply fix pack 1 or later. As a temporary workaround, consider restricting access to the com liferay asset publisher web portlet AssetPublisherPortlet INSTANCE XXXXXXXXXXXX assetEntryId parameter in the Asset Publisher app to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-29051
GHSA-JVVX-8G42-9559

Affected Products

Liferay Dxp
Liferay Portal