PT-2021-20113 · Liferay · Liferay Portal+1

Published 2021-08-03 · Updated 2022-05-24 · CVE-2021-33332

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.3.2 Liferay DXP versions 7.1 before fix pack 19 Liferay DXP versions 7.2 before fix pack 7

Description A cross-site scripting (XSS) issue in the Portlet Configuration module allows remote attackers to inject arbitrary web script or HTML via the com liferay portlet configuration css web portlet PortletConfigurationCSSPortlet portletResource parameter. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Liferay Portal versions 7.1.0 through 7.3.2, update to a version outside of this range or apply the necessary fix pack. For Liferay DXP version 7.1, apply fix pack 19 or later. For Liferay DXP version 7.2, apply fix pack 7 or later. As a temporary workaround, consider restricting access to the com liferay portlet configuration css web portlet PortletConfigurationCSSPortlet portletResource parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33332

GHSA-9995-QVCG-X7G6

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33332 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748366 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17053 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9995-qvcg-x7g6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33332 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/26780 · Telegram Post
• https://t.me/cvenotify/19135 · Telegram Post