Fluid Attacks Database

Description

Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console Liferay Server Admin Web before 4.0.12 from Liferay Portal v7.3.2 and below and Liferay DXP v7.0 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the script console under the Server module.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
maven	com.liferay:com.liferay.server.admin.web	>=0 <4.0.12	4.0.12
maven	com.liferay.portal:release.dxp.bom	>=0 <=7.0	-

Aliases

1. CVE-2021-382632. NVD-2021-382633. OSV-2021-382634. GCVE-2021-38263

References

1. https://github.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f62. https://github.com/liferay/liferay-portal/commit/771d99805b7ca69fecfcf67be5e24f2c1af1d0bb3. https://issues.liferay.com/browse/LPE-170614. https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38263-reflected-xss-with-script-page?p_r_p_assetEntryId=121611737&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611737%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse5. http://liferay.com