Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2021-38265 · ADVISORY
• liferay/liferay-portal commit ac82674 · WEB
• liferay/liferay-portal · PACKAGE
• liferay.atlassian.net/browse/LPE-17229 · WEB
• liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2021-38265-stored-xss-with-collection-name · WEB
• portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name · Patch

Lỗ hổng khác của com.liferay.portal:release.dxp.bom

• CVE-2025-43785TRUNG BÌNH 6.1Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2…
• CVE-2025-43776TRUNG BÌNH 5.4A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 202…
• CVE-2025-43734TRUNG BÌNH 5.4A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q…
• CVE-2025-43735TRUNG BÌNH 6.1A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q…
• CVE-2025-43736TRUNG BÌNH 4.3A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2…