CVE-2021-38263: Liferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script console
(updated )
Liferay Server Admin Web before 4.0.12 from Liferay Portal v7.3.2 and below and Liferay DXP v7.0 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the script console under the Server module.
References
- github.com/advisories/GHSA-ffmm-5ww2-g3q4
- github.com/liferay/liferay-portal
- github.com/liferay/liferay-portal/commit/1abb1bfc96242065f97c2828a02350ea2174f5f6
- github.com/liferay/liferay-portal/commit/771d99805b7ca69fecfcf67be5e24f2c1af1d0bb
- issues.liferay.com/browse/LPE-17061
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38263-reflected-xss-with-script-page?p_r_p_assetEntryId=121611737&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121611737%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
- nvd.nist.gov/vuln/detail/CVE-2021-38263
Code Behaviors & Features
Detect and mitigate CVE-2021-38263 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →