Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-38264 · ADVISORY
• liferay/liferay-portal commit f5df5cb · WEB
• liferay/liferay-portal · PACKAGE
• liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38264-reflected-xss-with-keywords-in-search · WEB
• portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38264-reflected-xss-with-keywords-in-search · Patch

com.liferay:com.liferay.frontend.taglib.clay のその他の脆弱性

• CVE-2025-43734中 5.4A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q…
• CVE-2022-42117中 6.1A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 befor…
• CVE-2021-35463中 6.1Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary w…