PT-2022-10707 · Liferay · Liferay Portal+1

Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38267

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.2 through 7.3.6 Liferay DXP 7.3 before fix pack 2

Description A cross-site scripting (XSS) issue exists in the Blogs module's edit blog entry page, allowing remote attackers to inject arbitrary web script or HTML via the com liferay blogs web portlet BlogsAdminPortlet title and com liferay blogs web portlet BlogsAdminPortlet subtitle parameters.

Recommendations For Liferay Portal versions 7.3.2 through 7.3.6, update to a version outside of this range to resolve the issue. For Liferay DXP 7.3 before fix pack 2, apply fix pack 2 or later to address the vulnerability. As a temporary workaround, consider restricting access to the Blogs module's edit blog entry page until a patch is available. Avoid using the com liferay blogs web portlet BlogsAdminPortlet title and com liferay blogs web portlet BlogsAdminPortlet subtitle parameters in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2021-38267

CVE-2021-38267

GHSA-R39X-3QQ4-GXMR

Affected Products

Liferay Dxp

Liferay Portal

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-38267 · Security Note
• https://osv.dev/vulnerability/BIT-liferay-2021-38267 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38267 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r39x-3qq4-gxmr · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/c3ad74d0664072c43da4d30a1d19be8cec3aa8bc · Note
• https://liferay.atlassian.net/browse/LPE-17212 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38267-stored-xss-with-title-and-subtitle-of-blog-entry?p_r_p_assetEntryId=121611935&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611935%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• http://liferay.com · Note
• https://t.me/cvenotify/31758 · Telegram Post