CVE-2021-38265

MEDIUM

Liferay Portal 7.3.4-7.3.6 - Stored Cross-Site Scripting via Asset List Portlet Title Parameter

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.

References (2)

Core 2

Core References

Product x_refsource_misc

http://liferay.com

Patch, Vendor Advisory x_refsource_misc

https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2021-38265-stored-xss-with-collection-name

Scores

CVSS v3 5.4

EPSS 0.0018

EPSS Percentile 38.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (4)

com.liferay/com.liferay.layout.admin.web 0 - 5.0.0Maven

com.liferay.portal/release.dxp.bom 0Maven

liferay/digital_experience_platform < 7.3

liferay/liferay_portal 7.3.4 - 7.3.6

Published Mar 03, 2022

Tracked Since Feb 18, 2026