PT-2021-20117 · Liferay · Liferay Portal+1

Published 2021-08-04 · Updated 2022-05-24 · CVE-2021-33336

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.3.3 Liferay DXP 7.1 fix pack 18 Liferay DXP 7.2 fix pack 5 through 7

Description A cross-site scripting (XSS) issue exists in the Journal module's add article menu, allowing remote attackers to inject arbitrary web script or HTML via the com liferay journal web portlet JournalPortlet name parameter. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Liferay Portal versions 7.3.0 through 7.3.3, update to a version outside of this range to resolve the issue. For Liferay DXP 7.1 fix pack 18, consider upgrading to a newer fix pack to mitigate the risk. For Liferay DXP 7.2 fix pack 5 through 7, restrict access to the Journal module's add article menu until a patch is available. As a temporary workaround, consider disabling the com liferay journal web portlet JournalPortlet name parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33336

GHSA-FVG6-9R88-7W85

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-33336-stored-xss-with-structure-name · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvg6-9r88-7w85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33336 · Security Note
• https://issues.liferay.com/browse/LPE-17078 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33336 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cvenotify/18619 · Telegram Post
• https://t.me/cibsecurity/26797 · Telegram Post