PT-2022-10705 · Liferay · Liferay Portal

Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38265

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.4 through 7.3.6

Description A cross-site scripting (XSS) issue exists in the Asset module, allowing remote attackers to inject arbitrary web script or HTML when creating a collection page. This is achieved via the com liferay asset list web portlet AssetListPortlet title parameter.

Recommendations For Liferay Portal versions 7.3.4 through 7.3.6, consider restricting access to the Asset module until a patch is available. As a temporary workaround, avoid using the com liferay asset list web portlet AssetListPortlet title parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2021-38265

CVE-2021-38265

GHSA-3X83-WHXW-PVMG

Affected Products

Liferay Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-38265 · Security Note
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3x83-whxw-pvmg · Vendor Advisory
• https://osv.dev/vulnerability/BIT-liferay-2021-38265 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38265 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/ac8267406785c2e70f4b15aadd604fbe7fb4451b · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38265-stored-xss-with-collection-name?p_r_p_assetEntryId=121611955&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611955%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/29238 · Telegram Post
• http://liferay.com · Note
• https://liferay.atlassian.net/browse/LPE-17229 · Note