CVE-2021-33332 — Cross-site Scripting in Portal

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 52.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Liferay PortalLiferay Digital Experience Platform
Timeline
PublishedAug 3
Latest updateMay 24

Description

Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_portlet_PortletConfigurationCSSPortlet_portletResource parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDliferay/liferay_portal7.1.0 — 7.3.3

Patches

Patch: issues.liferay.com ↗Patch: issues.liferay.com ↗

🔴Vulnerability Details

3
GHSA
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)↗2022-05-24
▶
OSV
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)↗2022-05-24
▶
CVEList
CVE-2021-33332: Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7↗2021-08-03
▶
CVE-2021-33332 — Cross-site Scripting in Liferay Portal | cvebase