Liferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameter

中危 6.1CVE-2021-38264 · GHSA-9536-m86r-q297 · Published 03/03/2022 · updated 09/07/2026

要点

CVE-2021-38264 是影响 com.liferay:com.liferay.frontend.taglib.clay, liferay portal (liferay) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.73%，高于 54.2% 的漏洞。
修复：升级到 7.1.15 或更高版本。

Package	Affected versions	Patched versions
com.liferay:com.liferay.frontend.taglib.clay Maven	`< 7.1.15`	`7.1.15`
liferay portal liferay	`= 7.4.0= 7.4.1`	No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.

References

com.liferay:com.liferay.frontend.taglib.clay 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.liferay:com.liferay.frontend.taglib.clay

Maven

< 7.1.15

7.1.15

liferay portal

liferay

= 7.4.0= 7.4.1

No fix yet

Description

Liferay Portal v7.4.1 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the keywords parameter under the Frontend Taglib module before 7.1.15.

NVD description

com.liferay:com.liferay.frontend.taglib.clay 的其他漏洞

查看全部 →