PT-2021-20120 · Liferay · Liferay Portal+1

Published 2021-08-04 · Updated 2022-05-24 · CVE-2021-33339

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.2.1 through 7.3.4 Liferay DXP 7.2 before fix pack 9

Description A cross-site scripting (XSS) issue in the Fragment module allows remote attackers to inject arbitrary web script or HTML via the com liferay site admin web portlet SiteAdminPortlet name parameter. This enables attackers to execute malicious scripts on the victim's browser.

Recommendations For Liferay Portal versions 7.2.1 through 7.3.4, update to a version outside of this range or apply the necessary fix. For Liferay DXP 7.2, apply fix pack 9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Fragment module until a patch is available. Avoid using the com liferay site admin web portlet SiteAdminPortlet name parameter in affected API endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33339

GHSA-7PXH-Q6JW-6XJ8

Affected Products

Liferay Dxp

Liferay Portal

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-33339 · Security Note
• https://osv.dev/vulnerability/GHSA-7pxh-q6jw-6xj8 · Vendor Advisory
• https://issues.liferay.com/browse/LPE-17102 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747934 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33339 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://t.me/cibsecurity/26798 · Telegram Post
• https://t.me/cvenotify/18618 · Telegram Post