Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

MEDIO 6.1CVE-2021-38264 · GHSA-9536-m86r-q297 · Published 03/03/2022 · updated 09/07/2026

In breve

CVE-2021-38264 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda com.liferay:com.liferay.frontend.taglib.clay, liferay portal (liferay).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.73%, superiore al 54.2% delle vulnerabilità.
Correzione: aggiornare a 7.1.15 o successiva.

Package	Affected versions	Patched versions
com.liferay:com.liferay.frontend.taglib.clay Maven	`< 7.1.15`	`7.1.15`
liferay portal liferay	`= 7.4.0= 7.4.1`	No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.

References

Altre vulnerabilità di com.liferay:com.liferay.frontend.taglib.clay

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.liferay:com.liferay.frontend.taglib.clay

Maven

< 7.1.15

7.1.15

liferay portal

liferay

= 7.4.0= 7.4.1

No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

Altre vulnerabilità di com.liferay:com.liferay.frontend.taglib.clay

Vedi tutto →