GHSA-239w-4f3w-cfcv

ghsaUSosv

Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page

view advisory published 2022-05-24Licence: CC-BY-4.0

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-29039US	medium6.1	0.75% (55th)	—	2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML…

references

External citations — patches, advisories, analysis.

http://liferay.comWEB
https://github.com/liferay/liferay-portalPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2021-29039ADVISORY
https://web.archive.org/web/20220828222833/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120777766WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan