PT-2022-10709 · Liferay · Liferay Portal+1

Mariani Francesco · Published 2022-03-02 · Updated 2024-01-31 · CVE-2021-38269

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.3.6 and 7.4.0 Liferay DXP versions 7.1.0 through 7.1 before fix pack 23 Liferay DXP versions 7.2.0 through 7.2 before fix pack 13 Liferay DXP versions 7.3.0 through 7.3 before fix pack 2

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Liferay Portal versions 7.1.0 through 7.3.6 and 7.4.0, update to a version outside of the affected range. For Liferay DXP version 7.1, apply fix pack 23 or later. For Liferay DXP version 7.2, apply fix pack 13 or later. For Liferay DXP version 7.3, apply fix pack 2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-LIFERAY-2021-38269

CVE-2021-38269

GHSA-VW6G-GH6C-8QWP

Affected Products

Liferay Dxp

Liferay Portal

References · 10

• https://osv.dev/vulnerability/BIT-liferay-2021-38269 · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38269-stored-xss-with-gogo-shell-output · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38269 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vw6g-gh6c-8qwp · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/0b28a0d0ca7592660c66c15aa14fe709b7c0c141 · Note
• https://liferay.atlassian.net/browse/LPE-17203 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38269-stored-xss-with-gogo-shell-output?p_r_p_assetEntryId=121611883&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611883%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• http://liferay.com · Note