Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)

中危 5.4CVE-2021-38265 · BIT-liferay-2021-38265 · GHSA-3x83-whxw-pvmg · Published 03/03/2022 · updated 09/07/2026

要点

CVE-2021-38265 是影响 com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.layout.admin.web, digital experience platform (liferay) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.58%，高于 47.9% 的漏洞。
修复：升级到 5.0.0 或更高版本。

Package	Affected versions	Patched versions
com.liferay.portal:release.dxp.bom Maven	`≤ 7.3`	No fix yet
com.liferay:com.liferay.layout.admin.web Maven	`< 5.0.0`	`5.0.0`
digital experience platform liferay	`≤ 7.3`	No fix yet
liferay portal liferay	`≥ 7.3.4, ≤ 7.3.6`	No fix yet

Description

Liferay Layout Admin Web before 5.0.0 in Liferay Portal v7.3.6 and below and Liferay DXP v7.3 and below were discovered to contain a cross-site scripting (XSS) vulnerability via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

NVD description

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.