PT-2022-10703 · Liferay · Liferay Portal+1

Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38263

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions prior to 7.3.2 Liferay DXP versions prior to 7.0 fix pack 101 Liferay DXP versions prior to 7.1 fix pack 20 Liferay DXP versions prior to 7.2 fix pack 10

Description A cross-site scripting (XSS) issue exists in the Server module's script console, allowing remote attackers to inject arbitrary web script or HTML via the output of a script. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Liferay Portal versions prior to 7.3.2, update to a version later than 7.3.2. For Liferay DXP versions prior to 7.0 fix pack 101, apply fix pack 101 or later. For Liferay DXP versions prior to 7.1 fix pack 20, apply fix pack 20 or later. For Liferay DXP versions prior to 7.2 fix pack 10, apply fix pack 10 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2021-38263

CVE-2021-38263

GHSA-FFMM-5WW2-G3Q4

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38263-reflected-xss-with-script-page · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38263 · Security Note
• https://issues.liferay.com/browse/LPE-17061 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38263 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffmm-5ww2-g3q4 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2021-38263 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f6 · Note
• https://github.com/liferay/liferay-portal/commit/771d99805b7ca69fecfcf67be5e24f2c1af1d0bb · Note
• http://liferay.com · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38263-reflected-xss-with-script-page?p_r_p_assetEntryId=121611737&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611737%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note