Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

보통 6.1CVE-2021-38264 · GHSA-9536-m86r-q297 · Published 03/03/2022 · updated 09/07/2026

요약

CVE-2021-38264은(는) com.liferay:com.liferay.frontend.taglib.clay, liferay portal (liferay)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.73%, 전체 취약점의 54.2%보다 높음.
조치: 7.1.15 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.liferay:com.liferay.frontend.taglib.clay Maven	`< 7.1.15`	`7.1.15`
liferay portal liferay	`= 7.4.0= 7.4.1`	No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.

References

com.liferay:com.liferay.frontend.taglib.clay의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.liferay:com.liferay.frontend.taglib.clay

Maven

< 7.1.15

7.1.15

liferay portal

liferay

= 7.4.0= 7.4.1

No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

com.liferay:com.liferay.frontend.taglib.clay의 다른 취약점

모두 보기 →